Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M

CVE-2026-39973Apktool: Path Traversal to Arbitrary File Write

High 7.1

In plain English

A high-severity path traversal in Apktool from iBotPeaches. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 92.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Apktool is a tool for reverse engineering Android APK files. In versions 3.0.0 and 3.0.1, a path traversal vulnerability in `brut/androlib/res/decoder/ResFileDecoder.java` allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding (`apktool d`). This is a security regression introduced in commit e10a045 (PR #4041, December 12, 2025), which removed the `BrutIO.sanitizePath()` call that previously prevented path traversal in resource file output paths. An attacker can embed `../` sequences in the `resources.arsc` Type String Pool to escape the output directory and write files to arbitrary locations, including `~/.ssh/config`, `~/.bashrc`, or Windows Startup folders, escalating to RCE. The fix in version 3.0.2 re-introduces `BrutIO.sanitizePath()` in `ResFileDecoder.java` before file write operations.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.apktool:apktool-lib	3.0.2	GHSA-m8mh-x359-vm8m
Ubuntu:22.04:LTS	apktool	no fix listed	UBUNTU-CVE-2026-39973
Ubuntu:24.04:LTS	apktool	no fix listed	UBUNTU-CVE-2026-39973
Ubuntu:25.10	apktool	no fix listed	UBUNTU-CVE-2026-39973
Ubuntu:26.04:LTS	apktool	no fix listed	UBUNTU-CVE-2026-39973
Ubuntu:26.10	apktool	no fix listed	UBUNTU-CVE-2026-39973

Affected products (as reported)

Vendor	Product	Versions
iBotPeaches	Apktool	>= 3.0.0, < 3.0.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-m8mh-x359-vm8m x_refsource_CONFIRM
https://github.com/iBotPeaches/Apktool/pull/4041 x_refsource_MISC
https://github.com/iBotPeaches/Apktool/commit/e10a0450c7afcd9462c0b76bcbff0e7428b92bdd#diff-cd531ebe1014bfd18185bf21585ca5cdb16fbcb07703ebc47949a1b4e4e36bc3 x_refsource_MISC
https://github.com/iBotPeaches/Apktool/releases/tag/v3.0.2 x_refsource_MISC