CVE-2026-39973

Apktool is a tool for reverse engineering Android APK files. In versions 3.0.0 and 3.0.1, a path traversal vulnerability in `brut/androlib/res/decoder/ResFileDecoder.java` allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding (`apktool d`). This is a security regression introduced in commit e10a045 (PR #4041, December 12, 2025), which removed the `BrutIO.sanitizePath()` call that previously prevented path traversal in resource file output paths. An attacker can embed `../` sequences in the `resources.arsc` Type String Pool to escape the output directory and write files to arbitrary locations, including `~/.ssh/config`, `~/.bashrc`, or Windows Startup folders, escalating to RCE. The fix in version 3.0.2 re-introduces `BrutIO.sanitizePath()` in `ResFileDecoder.java` before file write operations.

• CWE-22

• https://github.com/iBotPeaches/Apktool/commit/e10a0450c7afcd9462c0b76bcbff0e7428b92bdd#diff-cd531ebe1014bfd18185bf21585ca5cdb16fbcb07703ebc47949a1b4e4e36bc3Patch
• https://github.com/iBotPeaches/Apktool/pull/4041Issue Tracking
• https://github.com/iBotPeaches/Apktool/releases/tag/v3.0.2Product
• https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-m8mh-x359-vm8mMitigation, Vendor Advisory

Published

Apr 21, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39968TypeBot is a chatbot builder tool. In versions 3.15.2 and pr…7.1
• CVE-2026-39969TypeBot is a chatbot builder tool. In versions 3.16.0 and pr…6.5
• CVE-2026-3997The Text Toggle plugin for WordPress is vulnerable to Stored…6.4
• CVE-2026-39970TypeBot is a chatbot builder tool. Versions 3.15.2 and prior…8.5
• CVE-2026-39971Serendipity is a PHP-powered weblog engine. In versions 2.6-…7.2
• CVE-2026-39972Mercure is a protocol for pushing data updates to web browse…7.1
• CVE-2026-39974n8n-MCP is a Model Context Protocol (MCP) server that provid…8.5
• CVE-2026-39976Laravel Passport provides OAuth2 server support to Laravel. …7.1
• CVE-2026-39977flatpak-builder is a tool to build flatpaks from source. Fro…6.3
• CVE-2026-39979jq is a command-line JSON processor. In commits before 2f090…6.5
• CVE-2026-3998The WM JqMath plugin for WordPress is vulnerable to Stored C…6.4
• CVE-2026-39980OpenCTI is an open source platform for managing cyber threat…7.2