Adb Explorer
CVE-2026-27115
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCreate malicious shortcut with crafted path argument
-
ExploitLaunch ADB Explorer via shortcut
-
ExecutionClearDrag() method executes Directory.Delete()
-
ImpactRecursive deletion of arbitrary Windows directories
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | User must execute a malicious .lnk shortcut or batch script that passes an unvalidated path argument to ADB Explorer versions 0.9.26020 and below. No validation occurs on the path parameter before recursive directory deletion at startup/exit. |
| Impact | CVSS 7.1 (HIGH). Attack vector: Local. Complexity: Low. Privileges required: None. User interaction: Required. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to trigger recursive deletion of arbitrary directories on the Windows filesystem. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
ADB Explorer through version 0.9.26020 fails to validate user-supplied directory paths, enabling local attackers to trigger recursive deletion of arbitrary filesystem directories including critical system and user folders. An attacker can exploit this by crafting a malicious shortcut or script that launches the application with a sensitive path argument, causing permanent data loss when the application processes the ClearDrag() function at startup or exit. Any user tricked into launching ADB Explorer via a weaponized shortcut or batch file faces complete loss of targeted directories such as Documents or user profile folders.
Earlier versions of this analysis (1)
ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below have an unvalidated command-line argument that allows any user to trigger recursive deletion of arbitrary directories on the Windows filesystem. [CVSS 7.1 HIGH]
RemediationAI
Fixed in version 0.9.26021.. Validate and sanitize file path inputs. Use allowlists.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-22 (Path Traversal). ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below have an unvalidated command-line argument that allows any user to trigger recursive deletion of arbitrary directories on the Windows filesystem. ADB Explorer accepts an optional path argument to set a custom data directory, but only check whether the path exists. The ClearDrag() method calls Directory.Delete(dir, true) on every subdirectory of that path at both application startup and exit. An attacker can craft a malic
Know when Adb Explorer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9.26020 and below have an unvalidated command-line argument that allows any user to trigger recursive deletion of arbitrary directories on the Windows filesystem. ADB Explorer accepts an optional path argument to set a custom data directory, but only check whether the path exists. The ClearDrag() method calls Directory.Delete(dir, true) on every subdirectory of that path at both application startup and exit. An attacker can craft a malicious shortcut (.lnk) or batch script that launches ADB Explorer with a critical directory (e.g. C:\Users\%USERNAME%\Documents) as the argument, causing permanent recursive deletion of all its subdirectories. Any user who launches ADB Explorer via a crafted shortcut, batch file, or script loses the contents of the targeted directory permanently (deletion bypasses the Recycle Bin). This issue has been fixed in version 0.9.26021.
Executive ViewAI
ADB Explorer versions 0.9.26020 and below contain a critical flaw allowing unauthorized deletion of arbitrary files and folders on Windows systems. Any user with local access to affected machines can trigger cascading data loss, potentially compromising system stability, customer data, and business continuity. Immediate action is required to identify and remediate affected deployments.
Until a vendor patch is released: (1) Restrict execution of ADB Explorer through application whitelisting or Group Policy; (2) Implement file-level access controls on critical directories to prevent deletion; (3) Disable ADB Explorer on systems where it is not operationally required; (4) Monitor Windows file deletion events for suspicious bulk operations; (5) Enforce principle of least privilege to limit local user account capabilities; (6) Maintain current, tested backups of critical data independent of local filesystem access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB