Apktool Path Traversal: Arbitrary File Write Leads to RCE

The National Vulnerability Database has detailed CVE-2026-39973, a high-severity path traversal vulnerability in Apktool versions 3.0.0 and 3.0.1. This flaw, located in brut/androlib/res/decoder/ResFileDecoder.java, allows a maliciously crafted Android Package Kit (APK) to write arbitrary files to the filesystem during the standard decoding process (apktool d). An attacker can embed ../ sequences within the resources.arsc Type String Pool, enabling them to escape the intended output directory.

This is a critical security regression, stemming from commit e10a045 (PR #4041, December 12, 2025), which inadvertently removed the BrutIO.sanitizePath() call. This function previously prevented path traversal in resource file output paths. Its absence opens the door for attackers to write files to sensitive locations, such as ~/.ssh/config, ~/.bashrc, or Windows Startup folders. This arbitrary file write capability directly escalates to remote code execution (RCE).

Apktool version 3.0.2 addresses this vulnerability by re-introducing the BrutIO.sanitizePath() call within ResFileDecoder.java prior to any file write operations. The National Vulnerability Database assigns a CVSS score of 7.1 (HIGH) to this issue, underscoring its significant impact.