CVE-2026-39973: Apktool Path Traversal Vulnerability

CVE-2026-39973 Overview

CVE-2026-39973 is a path traversal vulnerability affecting Apktool, a popular tool used for reverse engineering Android APK files. This vulnerability exists in versions 3.0.0 and 3.0.1, where a security regression in brut/androlib/res/decoder/ResFileDecoder.java allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding operations using the apktool d command.

The vulnerability was introduced in commit e10a045 (PR #4041, December 12, 2025), which inadvertently removed the BrutIO.sanitizePath() call that previously prevented path traversal in resource file output paths. This removal created an opportunity for attackers to exploit the tool's decoding functionality.

Critical Impact

An attacker can embed ../ sequences in the resources.arsc Type String Pool to escape the output directory and write files to arbitrary locations, including ~/.ssh/config, ~/.bashrc, or Windows Startup folders, potentially escalating to Remote Code Execution (RCE).

Affected Products

• Apktool version 3.0.0
• Apktool version 3.0.1

Discovery Timeline

• 2026-04-21 - CVE-2026-39973 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-39973

Vulnerability Analysis

This path traversal vulnerability (CWE-22) stems from improper input validation during the APK decoding process. When Apktool processes an APK file, it reads resource file paths from the resources.arsc Type String Pool. Without proper sanitization, these paths can contain directory traversal sequences (../) that allow an attacker to escape the intended output directory.

The vulnerability requires local access and user interaction—specifically, a user must decode a maliciously crafted APK file. However, given the widespread use of Apktool among security researchers, Android developers, and malware analysts who routinely decode untrusted APK files, the attack surface is significant. The vulnerability can lead to high confidentiality and integrity impacts, as arbitrary file writes can overwrite sensitive configuration files or plant malicious executables.

Root Cause

The root cause is a security regression introduced in commit e10a045 as part of Pull Request #4041. This commit removed the critical BrutIO.sanitizePath() call from ResFileDecoder.java that was responsible for sanitizing output file paths before write operations. Without this sanitization step, user-controlled path data from the APK's resource table is used directly in file system operations, enabling path traversal attacks.

Attack Vector

The attack vector is local, requiring an attacker to craft a malicious APK file and convince a victim to decode it using a vulnerable version of Apktool. The attack sequence involves:

1. The attacker creates an APK with specially crafted entries in the resources.arsc Type String Pool containing ../ path traversal sequences
2. The victim downloads and attempts to decode the APK using apktool d malicious.apk
3. During the decoding process, ResFileDecoder.java processes resource file paths without sanitization
4. Files are written to arbitrary locations outside the intended output directory, such as ~/.ssh/config, ~/.bashrc, or Windows Startup folders

This can result in Remote Code Execution when malicious scripts or executables are written to auto-execution locations. For more technical details, see the GitHub Security Advisory.

Detection Methods for CVE-2026-39973

Indicators of Compromise

• Presence of unexpected files in user home directories (~/.ssh/, ~/.bashrc, etc.) or Windows Startup folders after APK decoding operations
• APK files with unusual resource paths containing ../ sequences in the resources.arsc file
• Modification timestamps on system configuration files coinciding with Apktool execution times
• Unusual entries in shell configuration files or SSH configurations that were not manually added

Detection Strategies

• Monitor file system writes during Apktool execution for paths containing ../ sequences or targeting sensitive directories
• Implement application whitelisting to detect unauthorized modifications to startup folders and shell configuration files
• Use file integrity monitoring (FIM) on critical user configuration files such as ~/.ssh/config, ~/.bashrc, and Windows Startup folders
• Analyze APK files before decoding by inspecting resources.arsc for suspicious path entries

Monitoring Recommendations

• Enable audit logging for file creation events in user profile directories and system startup locations
• Deploy endpoint detection and response (EDR) solutions to monitor for suspicious file write patterns following Apktool process execution
• Implement alerting for any file writes to ~/.ssh/, shell profile files, or Windows Startup directories by non-standard processes

How to Mitigate CVE-2026-39973

Immediate Actions Required

• Upgrade Apktool to version 3.0.2 or later immediately, which re-introduces BrutIO.sanitizePath() in ResFileDecoder.java
• Audit systems where vulnerable versions of Apktool (3.0.0 or 3.0.1) have been used to decode untrusted APK files
• Check for unauthorized modifications to sensitive configuration files and startup locations
• If compromise is suspected, restore affected files from known-good backups and investigate for additional indicators of compromise

Patch Information

The fix in version 3.0.2 re-introduces the BrutIO.sanitizePath() call in ResFileDecoder.java before file write operations. This sanitization function strips or rejects path traversal sequences, ensuring resource files are written only within the intended output directory. The specific changes can be reviewed in the commit changes.

Workarounds

• Avoid decoding untrusted APK files with vulnerable Apktool versions until upgrade is possible
• Run Apktool in a sandboxed environment or container with restricted filesystem access to limit potential damage from path traversal
• Use a dedicated, isolated virtual machine for APK analysis to contain any exploitation attempts
• Implement strict output directory permissions to prevent writes outside the intended location

# Run Apktool in a restricted container to mitigate risk
docker run --rm -v /path/to/apk:/work:ro -v /path/to/output:/output apktool:latest d /work/app.apk -o /output/decoded