CVE-2024-21633

Name: CVE-2024-21633
Creator: NVD / NIST
Published: 2024-01-03T17:15:13.103+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.8/10EPSS 1.32%

Last modified Jun 17, 2026

CVE-2024-21633 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Apktool is a tool for reverse engineering Android APK files. In versions 2.9.1 and prior, Apktool infers resource files' output path according to their resource names which can be manipulated by attacker to place files at desired location on the system Apktool runs on. EPSS estimates a 1.32% chance of exploitation in the next 30 days.

Description

Apktool is a tool for reverse engineering Android APK files. In versions 2.9.1 and prior, Apktool infers resource files' output path according to their resource names which can be manipulated by attacker to place files at desired location on the system Apktool runs on. Affected environments are those in which an attacker may write/overwrite any file that user has write access, and either user name is known or cwd is under user folder. Commit d348c43b24a9de350ff6e5bd610545a10c1fc712 contains a patch for this issue.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability

1.32%

67.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-22

Affected Software

Vendor	Product	Versions
Apktool	Apktool	< 2.9.2

References

https://github.com/iBotPeaches/Apktool/commit/d348c43b24a9de350ff6e5bd610545a10c1fc712Patch
https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-2hqv-2xv4-5h5wExploit, Patch, Vendor Advisory
https://github.com/iBotPeaches/Apktool/commit/d348c43b24a9de350ff6e5bd610545a10c1fc712Patch
https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-2hqv-2xv4-5h5wExploit, Patch, Vendor Advisory

Timeline

Published: Jan 3, 2024
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2024-21633?

How severe is CVE-2024-21633?

CVE-2024-21633 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 1.32% probability of exploitation in the next 30 days.

How do I fix CVE-2024-21633?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-21633?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST