CVE-2024-21633

Apktool is a tool for reverse engineering Android APK files. In versions 2.9.1 and prior, Apktool infers resource files' output path according to their resource names which can be manipulated by attacker to place files at desired location on the system Apktool runs on. Affected environments are those in which an attacker may write/overwrite any file that user has write access, and either user name is known or cwd is under user folder. Commit d348c43b24a9de350ff6e5bd610545a10c1fc712 contains a patch for this issue.

• CWE-22

• https://github.com/iBotPeaches/Apktool/commit/d348c43b24a9de350ff6e5bd610545a10c1fc712Patch
• https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-2hqv-2xv4-5h5wExploit, Patch, Vendor Advisory
• https://github.com/iBotPeaches/Apktool/commit/d348c43b24a9de350ff6e5bd610545a10c1fc712Patch
• https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-2hqv-2xv4-5h5wExploit, Patch, Vendor Advisory

Published

Jan 3, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21628PrestaShop is an open-source e-commerce platform. Prior to v…6.1
• CVE-2024-21629Rust EVM is an Ethereum Virtual Machine interpreter. In `rus…7.5
• CVE-2024-2163The Ninja Beaver Add-ons for Beaver Builder plugin for WordP…6.4
• CVE-2024-21630Zulip is an open-source team collaboration tool. A vulnerabi…4.3
• CVE-2024-21631Vapor is an HTTP web framework for Swift. Prior to version 4…6.5
• CVE-2024-21632omniauth-microsoft_graph provides an Omniauth strategy for t…9.8
• CVE-2024-21634Amazon Ion is a Java implementation of the Ion data notation…7.5
• CVE-2024-21635Memos is a privacy-first, lightweight note-taking service th…7.5
• CVE-2024-21636view_component is a framework for building reusable, testabl…6.1
• CVE-2024-21637Authentik is an open-source Identity Provider. Authentik is …5.4
• CVE-2024-21638Azure IPAM (IP Address Management) is a lightweight solution…9.8
• CVE-2024-21639CEF (Chromium Embedded Framework ) is a simple framework for…9.6