Researcher Proves apktool Vulnerability Fix Ineffective

The Advisory Said It Was Fixed. I Didn't Believe It Until I Broke It Myself.

The Android ecosystem relies heavily on tools like apktool for decompiling and rebuilding application packages (APKs). This utility is indispensable for security researchers, developers, and reverse engineers seeking to understand application internals, identify vulnerabilities, or modify existing applications. When a security advisory is published and subsequently marked as fixed, the expectation is that the threat has been neutralized. However, a recent investigation into apktool has revealed that this is not always the case, demonstrating the critical need for independent verification of security patches.

The vulnerability in question, CVE-2026-39973, was a path traversal bug. Such vulnerabilities typically allow an attacker to access files and directories outside of the intended scope by manipulating path-related inputs. In the context of apktool, a malicious resources.arsc file—a key component of an Android APK containing application resources—could trick the tool into writing decoded files to locations beyond its designated output directory. This could lead to overwriting critical system files, injecting malicious code, or exfiltrating sensitive data.

According to public advisories and the project's upstream repository, the vulnerability was patched. The standard procedure for such issues involves a developer identifying the flaw, implementing a code change to prevent it, and then merging that change into the main project branch. Once merged, the fix is typically released in a subsequent version, and security advisories are updated to reflect that the issue is resolved. For many, this signifies the end of the matter. The vulnerability is addressed, and users are advised to update to the patched version.

However, the researcher behind this investigation, who wishes to remain anonymous but is known for their work in application security, decided this was not enough. Driven by a desire to find real-world bugs rather than theoretical ones, they began a project to stress-test apktool. Their methodology involved not just examining known advisories but actively seeking out and attempting to reproduce reported issues, even those claimed to be fixed.

The Flaw in the Patch

The researcher's attention was drawn to CVE-2026-39973. While the advisory indicated a fix was in place, a nagging doubt persisted. The nature of path traversal bugs can be subtle, and fixes can sometimes be incomplete, leaving room for attackers to find alternative vectors or edge cases. This skepticism is a healthy trait in security work. It’s the same principle that drives rigorous testing in software development: assume nothing, verify everything.

Diving into the apktool codebase and the details of the reported patch, the researcher began to formulate their own test cases. The goal was to recreate the conditions that would trigger the vulnerability and see if the implemented safeguards held up. What they discovered was that the original patch, while addressing the most obvious way to exploit the path traversal, had failed to account for a critical nuance in how apktool handled certain file paths and directory structures.

The core of the issue lay in the way the tool parsed and processed resource files during the decoding and rebuilding process. The patched code might have prevented direct use of `../` sequences in certain contexts, but it failed to adequately sanitize or validate paths that were constructed in a more complex, multi-step manner. This meant that by carefully crafting a malicious resources.arsc file, an attacker could still construct a path that, when processed by apktool, would resolve to a location outside the intended output directory. The researcher was able to demonstrate that the tool could be made to write files to arbitrary locations on the filesystem, effectively bypassing the supposed fix.