PT-2026-33645 · Apktool · Apktool

Published 2026-04-19 · Updated 2026-04-28 · CVE-2026-39973

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apktool versions 3.0.0 through 3.0.1

Description A path traversal issue in brut/androlib/res/decoder/ResFileDecoder.java allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding using the apktool d command. This occurs because the BrutIO.sanitizePath() call, which previously prevented path traversal in resource file output paths, was removed. An attacker can embed ../ sequences in the resources.arsc Type String Pool to escape the output directory and write files to arbitrary locations, such as ~/.ssh/config, ~/.bashrc, or Windows Startup folders, potentially leading to remote code execution.

Recommendations Update to version 3.0.2.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-39973

GHSA-M8MH-X359-VM8M

Affected Products

Apktool

References · 15

• https://github.com/iBotPeaches/Apktool/commit/e10a0450c7afcd9462c0b76bcbff0e7428b92bdd#diff-cd531ebe1014bfd18185bf21585ca5cdb16fbcb07703ebc47949a1b4e4e36bc3 · Patch
• https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-m8mh-x359-vm8m · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-39973 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m8mh-x359-vm8m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39973 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-39973 · Security Note
• https://ubuntu.com/security/CVE-2026-39973 · Vendor Advisory
• https://github.com/iBotPeaches/Apktool · Note
• https://github.com/iBotPeaches/Apktool/pull/4041 · Note
• https://github.com/iBotPeaches/Apktool/releases/tag/v3.0.2 · Note
• https://twitter.com/iBotPeaches/status/2045845523567960523 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1sug4za/resumen_diario_de_vulnerabilidades_24042026 · Reddit Post
• https://twitter.com/dailycve/status/2047468291791155636 · Twitter Post
• https://twitter.com/CVEnew/status/2046571858657763451 · Twitter Post
• https://twitter.com/_cvereports/status/2049063763207196986 · Twitter Post