Path Traversal Vulnerability in Apktool Affects Reverse Engineering of Android APK Files

CVE-2026-39973

What is CVE-2026-39973?

A path traversal vulnerability exists in Apktool versions 3.0.0 and 3.0.1, where a maliciously crafted APK can exploit the absence of path sanitization. By incorporating ../ sequences in the resource file structure, an attacker can manipulate the output paths during the decoding process (apktool d) and write files to arbitrary locations on the filesystem. This flaw allows potential unauthorized access to sensitive files, thereby posing a significant security risk. The vulnerability was addressed in version 3.0.2, which reinstated the necessary path sanitation measures.

References