GitHub Advisoryadvisory · Maven

GHSA-m8mh-x359-vm8m Apktool: Path Traversal to Arbitrary File Write

HIGH Published 2026-04-23 Modified 2026-04-23 Official page ↗
Aliases
CVE-2026-39973
Ecosystem
Maven
Packages
org.apktool:apktool-lib
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-22
Reviewed
2026-04-23

Affected packages

• Maven org.apktool:apktool-lib: >= 3.0.0, < 3.0.2 → fixed in 3.0.2

Description

A path traversal vulnerability in `brut/androlib/res/decoder/ResFileDecoder.java` allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding (`apktool d`). This is a security regression introduced in commit e10a045 (PR #4041, December 12, 2025), which removed the `BrutIO.sanitizePath()` call that previously prevented path traversal in resource file output paths. An attacker can embed `../` sequences in the `resources.arsc` Type String Pool to escape the output directory and write files to arbitrary locations, including `~/.ssh/config`, `~/.bashrc`, or Windows Startup folders, escalating to RCE. Fix: Re-introduce `BrutIO.sanitizePath()` in `ResFileDecoder.java` before file write operations.

Related

Alias · CVE (1)

  • CVE-2026-39973 Apktool is a tool for reverse engineering Android APK files. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References