CVE-2026-39973

🗓️ 21 Apr 2026 01:35:22Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 121 Views

CVE-2026-39973: Apktool path traversal allows arbitrary file writes during decoding in 3.0.0/3.0.1; fixed in 3.0.2.

Reporter	Title	Published	Views	Family All 19
ATTACKERKB	CVE-2026-39973	21 Apr 202601:35	–	attackerkb
BDU FSTEC	The vulnerability in the file brut/androlib/res/decoder/ResFileDecoder.java of the Android APK reverse-engineering tool Apktoo,l allows a hacker to write or rewrite any data.	27 May 202600:00	–	bdu_fstec
Circl	CVE-2026-39973	19 Apr 202612:42	–	circl
CNNVD	Apktool 路径遍历漏洞	21 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-39973 Apktool: Path Traversal to Arbitrary File Write	21 Apr 202601:35	–	cvelist
GithubExploit	Exploit for Path Traversal in Apktool	30 Apr 202617:58	–	githubexploit
Debian CVE	CVE-2026-39973	21 Apr 202601:35	–	debiancve
EUVD	EUVD-2026-24043	23 Apr 202621:24	–	euvd
Github Security Blog	Apktool: Path Traversal to Arbitrary File Write	23 Apr 202621:24	–	github
NVD	CVE-2026-39973	21 Apr 202602:16	–	nvd

NVD

Vulners

Node

apktool apktoolRange3.0.0–3.0.2

[
  {
    "vendor": "iBotPeaches",
    "product": "Apktool",
    "versions": [
      {
        "version": ">= 3.0.0, < 3.0.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/iBotPeaches/Apktool/security/advisories/GHSA-m8mh-x359-vm8m
github	www.github.com/iBotPeaches/Apktool/pull/4041
github	www.github.com/iBotPeaches/Apktool/releases/tag/v3.0.2
github	www.github.com/iBotPeaches/Apktool/commit/e10a0450c7afcd9462c0b76bcbff0e7428b92bdd

17 Jun 2026 10:42Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.1

EPSS0.00182

SSVC

CWE-22