Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-39973 is a high-severity Path Traversal (CWE-22) vulnerability in Apktool Apktool. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-39973 is a path traversal vulnerability (CWE-22) affecting Apktool versions 3.0.0 and 3.0.1, a tool used for reverse engineering Android APK files. The issue resides in the `brut/androlib/res/decoder/ResFileDecoder.java` component and enables a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding operations with the `apktool d` command. This flaw represents a security regression introduced by commit e10a045 (PR #4041, dated December 12, 2025), which removed the `BrutIO.sanitizePath()` call previously used to prevent path traversal in resource file output paths. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).
An attacker can exploit this vulnerability locally by providing a victim with a specially crafted APK containing `../` sequences embedded in the `resources.arsc` Type String Pool. If the victim, such as a security researcher or reverse engineer, runs `apktool d` on the malicious APK, it escapes the intended output directory and writes files to arbitrary locations on the filesystem. Potential targets include sensitive paths like `~/.ssh/config`, `~/.bashrc` on Unix-like systems, or Windows Startup folders, potentially leading to remote code execution (RCE) through privilege escalation or persistent access.
Mitigation is available via upgrade to Apktool version 3.0.2, which re-introduces the `BrutIO.sanitizePath()` function in `ResFileDecoder.java` prior to file write operations. Official advisories and resources, including the GitHub security advisory (GHSA-m8mh-x359-vm8m), release notes for v3.0.2, the original pull request #4041, and the regressing commit e10a045, detail the issue and fix for practitioners to review and apply.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24043
Vulnerability Data
Apktool is a tool for reverse engineering Android APK files. In versions 3.0.0 and 3.0.1, a path traversal vulnerability in `brut/androlib/res/decoder/ResFileDecoder.java` allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding (`apktool d`). This is…
more
a security regression introduced in commit e10a045 (PR #4041, December 12, 2025), which removed the `BrutIO.sanitizePath()` call that previously prevented path traversal in resource file output paths. An attacker can embed `../` sequences in the `resources.arsc` Type String Pool to escape the output directory and write files to arbitrary locations, including `~/.ssh/config`, `~/.bashrc`, or Windows Startup folders, escalating to RCE. The fix in version 3.0.2 re-introduces `BrutIO.sanitizePath()` in `ResFileDecoder.java` before file write operations.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2
Mitigating Controls (NIST 800-53 r5) AI
Enforces the intended directory access authorizations that path traversal would otherwise bypass.
Input validation directly neutralizes special path elements before pathname construction occurs.
Least privilege reduces the impact of any unauthorized file access obtained via traversal.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis.
Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.
Application security requirements include rules for safe file handling and canonicalization.
Secure architecture principles require least-privilege file access and directory isolation.
Secure coding standards explicitly forbid unsafe path construction and mandate safe APIs.
Information access restriction limits which files an application may read or write.