Vulnerabilities in pkg:maven/org.apktool/apktool-lib

PACKAGE
Advisory Identifier: GHSA-m8mh-x359-vm8m
Share
Advisory Summary

CVE-2026-39973 is a HIGH (CVSS 7.1) path traversal vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Apktool libraries in the Maven ecosystem. The issue involves path traversal to arbitrary file write. Remediation is available by upgrading affected packages to version 3.0.2.

1 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:maven/org.apktool/apktool-lib

1 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:maven/org.apktool/apktool-lib. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-m8mh-x359-vm8m CVE-2026-39973 HIGH Apktool: Path Traversal to Arbitrary File Write

CVE-2026-39973 at a Glance

CVE Identifier CVE-2026-39973
GHSA Identifier GHSA-m8mh-x359-vm8m
Severity HIGH
CVSS v3.1 Base Score 7.1
CWE Classification CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Product Apktool
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction Required (UI:R)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability None (A:N)

How to Fix CVE-2026-39973

To remediate this vulnerability, upgrade all affected Apktool dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.apktool:apktool-lib fixed: 3.0.2 
<dependency>
    <groupId>org.apktool</groupId>
    <artifactId>apktool-lib</artifactId>
    <version>3.0.2</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=org.apktool

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-39973, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.apktool

Analyze the terminal output to locate any version of Apktool in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.0.2), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.apktool command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Apktool, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

A path traversal vulnerability in `brut/androlib/res/decoder/ResFileDecoder.java` allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding (`apktool d`). This is a security regression introduced in commit [e10a045](https://github.com/iBotPeaches/Apktool/commit/e10a0450c7afcd9462c0b76bcbff0e7428b92bdd#diff-cd531ebe1014bfd18185bf21585ca5cdb16fbcb07703ebc47949a1b4e4e36bc3) ([PR #4041](https://github.com/iBotPeaches/Apktool/pull/4041), December 12, 2025), which removed the `BrutIO.sanitizePath()` call that previously prevented path traversal in resource file output paths. An attacker can embed `../` sequences in the `resources.arsc` Type String Pool to escape the output directory and write files to arbitrary locations, including `~/.ssh/config`, `~/.bashrc`, or Windows Startup folders, escalating to RCE. **Fix:** Re-introduce `BrutIO.sanitizePath()` in `ResFileDecoder.java` before file write operations.

CVE-2026-39973 Affected Apktool Versions

1 component(s)
Fixed Versions:
3.0.2
Product / Package Ecosystem Affected Versions Fixed Version
org.apktool:apktool-lib
maven/org.apktool/apktool-lib
Maven
≥ 3.0.0
< 3.0.2
3.0.2

References

GitHub Advisory / Wiki ADVISORY
https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-m8mh-x359-vm8m
NVD — CVE-2026-39973 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-39973
Apktool Source Repository REPOSITORY
https://github.com/iBotPeaches/Apktool/pull/4041
Security Fix Commit FIX COMMIT
https://github.com/iBotPeaches/Apktool/commit/e10a0450c7afcd9462c0b76bcbff0e7428b92bdd#diff-cd531ebe1014bfd18185bf21585ca5cdb16fbcb07703ebc47949a1b4e4e36bc3
Apktool Source Repository REPOSITORY
https://github.com/iBotPeaches/Apktool
Apktool Release RELEASE
https://github.com/iBotPeaches/Apktool/releases/tag/v3.0.2

Frequently Asked Questions

What is CVE-2026-39973?
CVE-2026-39973 is a security vulnerability in Apktool involving Path Traversal to Arbitrary File Write under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
Which Apktool versions are affected?
Affected versions include releases prior to 3.0.2 across affected packages: org.apktool:apktool-lib.
What version fixes CVE-2026-39973?
Upgrading to 3.0.2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is apktool-lib affected?
Yes, org.apktool:apktool-lib is affected in releases prior to 3.0.2. Upgrade your dependency to 3.0.2 or later.
What is the CVSS score of CVE-2026-39973?
CVE-2026-39973 has a CVSS v3.1 base score of 7.1 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N.
What CWE is associated with CVE-2026-39973?
CVE-2026-39973 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).
How can I check Maven dependencies for CVE-2026-39973?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.apktool'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-m8mh-x359-vm8m",
  "modified" : "2026-04-23T21:24:28Z",
  "published" : "2026-04-23T21:24:28Z",
  "aliases" : [ "CVE-2026-39973" ],
  "summary" : "Apktool: Path Traversal to Arbitrary File Write",
  "details" : "A path traversal vulnerability in `brut/androlib/res/decoder/ResFileDecoder.java` allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding (`apktool d`). This is a security regression introduced in commit [e10a045](https://github.com/iBotPeaches/Apktool/commit/e10a0450c7afcd9462c0b76bcbff0e7428b92bdd#diff-cd531ebe1014bfd18185bf21585ca5cdb16fbcb07703ebc47949a1b4e4e36bc3) ([PR #4041](https://github.com/iBotPeaches/Apktool/pull/4041), December 12, 2025), which removed the `BrutIO.sanitizePath()` call that previously prevented path traversal in resource file output paths.\n\nAn attacker can embed `../` sequences in the `resources.arsc` Type String Pool to escape the output directory and write files to arbitrary locations, including `~/.ssh/config`, `~/.bashrc`, or Windows Startup folders, escalating to RCE.\n\n**Fix:** Re-introduce `BrutIO.sanitizePath()` in `ResFileDecoder.java` before file write operations.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apktool:apktool-lib"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "3.0.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-m8mh-x359-vm8m"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-39973"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/iBotPeaches/Apktool/pull/4041"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/iBotPeaches/Apktool/commit/e10a0450c7afcd9462c0b76bcbff0e7428b92bdd#diff-cd531ebe1014bfd18185bf21585ca5cdb16fbcb07703ebc47949a1b4e4e36bc3"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/iBotPeaches/Apktool"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/iBotPeaches/Apktool/releases/tag/v3.0.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-23T21:24:28Z",
    "nvd_published_at" : "2026-04-21T02:16:07Z"
  }
}