CVE-2026-39973

{"id": "CVE-2026-39973", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39973", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-22T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "iBotPeaches", "product": "Apktool", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.0.2"}]}]}], "published": "2026-04-21T02:16:07.903", "references": [{"url": "https://github.com/iBotPeaches/Apktool/commit/e10a0450c7afcd9462c0b76bcbff0e7428b92bdd#diff-cd531ebe1014bfd18185bf21585ca5cdb16fbcb07703ebc47949a1b4e4e36bc3", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/iBotPeaches/Apktool/pull/4041", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/iBotPeaches/Apktool/releases/tag/v3.0.2", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-m8mh-x359-vm8m", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Apktool is a tool for reverse engineering Android APK files. In versions 3.0.0 and 3.0.1, a path traversal vulnerability in `brut/androlib/res/decoder/ResFileDecoder.java` allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding (`apktool d`). This is a security regression introduced in commit e10a045 (PR #4041, December 12, 2025), which removed the `BrutIO.sanitizePath()` call that previously prevented path traversal in resource file output paths. An attacker can embed `../` sequences in the `resources.arsc` Type String Pool to escape the output directory and write files to arbitrary locations, including `~/.ssh/config`, `~/.bashrc`, or Windows Startup folders, escalating to RCE. The fix in version 3.0.2 re-introduces `BrutIO.sanitizePath()` in `ResFileDecoder.java` before file write operations."}, {"lang": "es", "value": "Apktool es una herramienta para la ingenier\u00eda inversa de archivos APK de Android. En las versiones 3.0.0 y 3.0.1, una vulnerabilidad de salto de ruta en \u201cbrut/androlib/res/decoder/ResFileDecoder.java\u201d permite que un APK creado con fines maliciosos escriba archivos arbitrarios en el sistema de archivos durante la decodificaci\u00f3n est\u00e1ndar (\u201capktool d\u201d). Esto es una regresi\u00f3n de seguridad introducida en el commit e10a045 (PR #4041, 12 de diciembre de 2025), que elimin\u00f3 la llamada a \u201cBrutIO.sanitizePath()\u201d que previamente preven\u00eda el salto de ruta en las rutas de salida de los archivos de recursos. Un atacante puede incrustar secuencias \u201c.. / \u201d en el Type String Pool de \u201cresources.arsc\u201d para escapar del directorio de salida y escribir archivos en ubicaciones arbitrarias, incluyendo \u201c~/.ssh/config\u201d, \u201c~/.bashrc\u201d, o carpetas de inicio de Windows, escalando a RCE. La correcci\u00f3n en la versi\u00f3n 3.0.2 reintroduce \u201cBrutIO.sanitizePath()\u201d en \u201cResFileDecoder.java\u201d antes de las operaciones de escritura de archivos."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apktool:apktool:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3AB0F220-1C11-421A-B777-AF3FA75A7830", "versionEndExcluding": "3.0.2", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}