CVE-2026-39973

OVERVIEW CVE-2026-39973 is a path traversal vulnerability affecting Apktool versions 3.0.0 and 3.0.1, tools commonly used for reverse engineering Android APK files. The flaw exists in the resource file decoder component and allows attackers to write arbitrary files to the filesystem when decoding a maliciously crafted APK file. This represents a security regression introduced in December 2025 when developers removed input sanitization checks that previously prevented directory traversal attacks. SEVERITY The vulnerability carries a CVSS score of 7.1 (HIGH) with a local attack vector requiring user interaction but no special privileges. An attacker can embed path traversal sequences in APK resource files to escape the intended output directory and write files to sensitive locations such as SSH configuration directories, shell startup files, or Windows Startup folders. Successful exploitation could lead to remote code execution if malicious files are placed in system-critical locations, representing both high integrity and confidentiality impacts. EXPLOITATION STATUS Currently, there is no indication of active exploitation in the wild, as the vulnerability does not appear on CISA's Known Exploited Vulnerabilities catalog. The EPSS probability score is extremely low at 0.00014, suggesting minimal real-world exploitation activity. However, organizations using Apktool 3.0.0 or 3.0.1 should upgrade to version 3.0.2 immediately, which restores the removed path sanitization function to prevent this attack vector.