{"identifier":"CVE-2026-39973","cve":{"id":"CVE-2026-39973","description":"Apktool is a tool for reverse engineering Android APK files. In versions 3.0.0 and 3.0.1, a path traversal vulnerability in `brut/androlib/res/decoder/ResFileDecoder.java` allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding (`apktool d`). This is a security regression introduced in commit e10a045 (PR #4041, December 12, 2025), which removed the `BrutIO.sanitizePath()` call that previously prevented path traversal in resource file output paths. An attacker can embed `../` sequences in the `resources.arsc` Type String Pool to escape the output directory and write files to arbitrary locations, including `~/.ssh/config`, `~/.bashrc`, or Windows Startup folders, escalating to RCE. The fix in version 3.0.2 re-introduces `BrutIO.sanitizePath()` in `ResFileDecoder.java` before file write operations.","published":"2026-04-21T02:16:07.903000+00:00","modified":"2026-10-26T22:10:00.163000+00:00","status":"Analyzed","score":7.1,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_version":"3.1","affected":[{"criteria":"cpe:2.3:a:apktool:apktool:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"3.0.2"}],"weaknesses":["CWE-22"],"references":[{"url":"https://github.com/iBotPeaches/Apktool/commit/e10a0450c7afcd9462c0b76bcbff0e7428b92bdd#diff-cd531ebe1014bfd18185bf21585ca5cdb16fbcb07703ebc47949a1b4e4e36bc3","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/iBotPeaches/Apktool/pull/4041","source":"security-advisories@github.com","tags":["Issue Tracking"]},{"url":"https://github.com/iBotPeaches/Apktool/releases/tag/v3.0.2","source":"security-advisories@github.com","tags":["Product"]},{"url":"https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-m8mh-x359-vm8m","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}],"kev":null,"kev_checked":true,"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-22T00:00:00+00:00","id":"CVE-2026-39973","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apktool:apktool:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.0.2","matchCriteriaId":"3AB0F220-1C11-421A-B777-AF3FA75A7830"}]}]}],"source":"nvd","retrieved_at":"2026-10-28T10:19:21.276521+00:00","exploited":false,"kev_stale":false,"products":["apktool / apktool"],"priority":{"label":"Assess exposure and vendor guidance","reasons":["No higher-priority signal is available in the current stored evidence."]},"epss":{"probability":0.00182,"percentile":0.07769,"date":"2026-10-28","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"github.com","source_url":"https://github.com/iBotPeaches/Apktool/commit/e10a0450c7afcd9462c0b76bcbff0e7428b92bdd#diff-cd531ebe1014bfd18185bf21585ca5cdb16fbcb07703ebc47949a1b4e4e36bc3","investigate_url":"https://investigate.aeglixmind.com/#github.com"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2026-39973","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2026-39973","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2026-39973","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}