CVE-2026-39973Disclosure(apktool / apktool)

LOWCVSS 7.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch apktool apktool systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Apktool is a tool for reverse engineering Android APK files. In versions 3.0.0 and 3.0.1, a path traversal vulnerability in `brut/androlib/res/decoder/ResFileDecoder.java` allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding (`apktool d`). This is a security regression introduced in commit e10a045 (PR #4041, December 12, 2025), which removed the `BrutIO.sanitizePath()` call that previously prevented path traversal in resource file output paths. An attacker can embed `../` sequences in the `resources.arsc` Type String Pool to escape the output directory and write files to arbitrary locations, including `~/.ssh/config`, `~/.bashrc`, or Windows Startup folders, escalating to RCE. The fix in version 3.0.2 re-introduces `BrutIO.sanitizePath()` in `ResFileDecoder.java` before file write operations.

apktool CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/iBotPeaches/Apktool/commit/e10a0450c7afcd9462c0b76bcbff0e7428b92bdd#diff-cd531ebe1014bfd18185bf21585ca5cdb16fbcb07703ebc47949a1b4e4e36bc3

Vendor / third-party advisories

https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-m8mh-x359-vm8m

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

apktool

Threat summary

Patch or workaround signal is available
4 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 3 classified signals
Peaked 3d ago at 1 mentions (2026-04-19); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

apktool

Products

apktool

Deep dive

Activity timeline4 mentions / 4d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-19	1	Patch1
2026-04-21	1	Disclosure1
2026-04-24	1	Disclosure1
2026-04-28	1	Disclosure1

Full discourse4 posts

Connor Tumbleson@iBotPeaches172d
Patch
apktool 3.0.2 is out! - performance boosts - CVE-2026-39973 fix - bug fixes for splits & Meta apks https://apktool.org/blog/apktool-3.0.2
Post summary
apktool 3.0.2 release notes highlight a fix for CVE-2026-39973, along with performance improvements and bug fixes.
01042304
1.2K followersView on X
cvereports@_cvereports163d
Disclosure
CVE-2026-39973: CVE-2026-39973: Arbitrary File Write via Path Traversal in Apktool Apktool versions 3.0.0 and 3.0.1 contain a high-severity path traversal vulnerability due to a security regression in resource decoding. By crafting a malicious APK wit... https://cvereports.com/reports/CVE-2026-39973
Post summary
The post publicly discloses a high‑severity path traversal vulnerability in Apktool 3.0.0 and 3.0.1 that allows arbitrary file writes, but it does not provide a PoC, exploit code, or mitigation details.
0000025
36 followersView on X
DailyCVE@dailycve168d
Disclosure
🔴 Apktool Path Traversal to Arbitrary File Write #CVE-2026-39973 (High) https://dailycve.com/apktool-path-traversal-to-arbitrary-file-write-cve-2026-39973-high/
Post summary
The message announces CVE-2026-39973, a path-traversal to arbitrary file write flaw in Apktool with high severity, but offers no technical, exploit, or mitigation details.
0000055
183 followersView on X
CVE@CVEnew170d
Disclosure
CVE-2026-39973 Apktool is a tool for reverse engineering Android APK files. In versions 3.0.0 and 3.0.1, a path traversal vulnerability in `brut/androlib/res/decoder/ResFileDecoder.… https://www.cve.org/CVERecord?id=CVE-2026-39973
Post summary
The post announces CVE-2026-39973, a path traversal flaw in Apktool's ResFileDecoder for versions 3.0.0 and 3.0.1, and links to the official CVE record. It offers no proof of concept, exploit, patch, or evidence of active exploitation.
00000136
57.2K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apktool	apktool	-	-	-

Explore more

Back to dashboard apktool CVEs apktool vulnerabilities

What researchers are saying

CVE-2026-39973

Connor Tumbleson@iBotPeachesPatch

apktool 3.0.2 release notes highlight a fix for CVE-2026-39973, along with performance improvements and bug fixes.

cvereports@_cvereportsDisclosure

The post publicly discloses a high‑severity path traversal vulnerability in Apktool 3.0.0 and 3.0.1 that allows arbitrary file writes, but it does not provide a PoC, exploit code, or mitigation details.

DailyCVE@dailycveDisclosure

The message announces CVE-2026-39973, a path-traversal to arbitrary file write flaw in Apktool with high severity, but offers no technical, exploit, or mitigation details.

CVE@CVEnewDisclosure

The post announces CVE-2026-39973, a path traversal flaw in Apktool's ResFileDecoder for versions 3.0.0 and 3.0.1, and links to the official CVE record. It offers no proof of concept, exploit, patch, or evidence of active exploitation.