Apktool Resource Table Path Traversal — Malicious APK Builder (CVE-2026-39973)

Metadata

Affected Target

Summary

Apktool decodes an APK’s resources.arsc to reconstruct resource file paths during decompilation, and a security regression (commit e10a045, PR #4041) removed the BrutIO.detectPossibleDirectoryTraversal() check that previously validated the fully-built output path. While the resource entry name is still validated, the resource type name is not, so a crafted resources.arsc can set a type name containing ..\ sequences to escape the intended output directory. This PoC is a small C# builder that hand-crafts a resources.arsc (writing a ResTable/ResPackage/ResType with a traversal sequence baked into the type name) packaged inside an APK, so that running apktool d on the file writes an attacker-chosen payload to an arbitrary path such as a user’s ~/.bashrc or the Windows Startup folder.

Vulnerability Details

Root Cause

Improper limitation of a pathname (CWE-22): Apktool’s ResFileDecoder.outResPath construction was simplified to drop path-traversal validation on the composed output path, while only validating the resource entry name upstream — leaving the resource type name as an unchecked injection point for ..\ sequences.

Attack Vector

1. Attacker runs the included C# builder to generate a malicious APK, choosing a payload file and a target mode (Windows Startup folder or Linux ~/.bashrc).
2. The builder crafts a resources.arsc whose ResType name embeds a long ..\..\..\ traversal sequence followed by the victim’s Startup path (or bashrc path), and packages it with the payload bytes in a ZIP/APK container.
3. Attacker delivers the crafted APK to a victim who decompiles it (e.g., apktool d malicious.apk).
4. Apktool decodes the resource, builds the output path from the unvalidated type name, and writes the payload file outside the intended decompilation output directory — e.g., into the Windows Startup folder for auto-execution on next login, or appending to ~/.bashrc for shell execution.

Impact

Arbitrary file write (and, depending on the destination chosen, arbitrary code execution on the victim’s machine) triggered simply by decompiling an attacker-supplied APK with a vulnerable Apktool version.

Environment / Lab Setup

Target:   Apktool 3.0.1 (or any build still missing the outResPath traversal check)
Attacker: .NET SDK to build/run the C# APK builder project in src/

Proof of Concept

PoC Script

See src/Program.cs (entry point) and the supporting Data/, Enum/, Writer/ classes in the src/ folder.

1
2

cd src
dotnet run -- /path/to/payload.file

The tool reads a payload file, builds a resources.arsc containing a ResType whose name embeds a ..\ traversal sequence pointing at the victim’s Startup folder (or bashrc path), packages it with the payload into a ZIP archive named cve-2026-39973-out-<id>.apk, and writes the resulting APK to disk — ready to hand to a victim for decompilation with a vulnerable Apktool.

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected executables or scripts present in Startup Menu\Programs\Startup shortly after decompiling a third-party APK
• Unexplained appended lines in ~/.bashrc after running Apktool on an untrusted file
• resources.arsc files containing ResType names with ..\ or ../ sequences

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/frawlaboy/CVE-2026-39973-PoC on 2026-07-05.