A path traversal vulnerability in iBotPeaches Apktool versions 3.0.0 and 3.0.1 poses a critical risk by allowing arbitrary file writes, which can lead to remote code execution on the host machine.

The software fails to sanitize file paths within the resource output directory, allowing unauthenticated users to use malicious APK files to traverse directories. This flaw occurs during the standard decoding process when the tool writes decoded resources to the local filesystem.

The ability to write files to arbitrary locations on a host system is severe, as it permits attackers to overwrite sensitive configuration files or startup scripts. Given the CVSS score of 7.1, this high-severity vulnerability could lead to total system compromise, unauthorized data access, or the execution of malicious code under the context of the user running the tool.

Immediate Action: Update iBotPeaches Apktool to version 3.0.2 or later, which re-introduces the necessary path sanitization logic to prevent directory traversal.

Proactive Monitoring: Review file system changes and audit logs for unauthorized file creation or modification occurring in sensitive directories, such as SSH or startup folders, after executing Apktool.

Compensating Controls: If an immediate update is not feasible, restrict the use of Apktool to isolated, sandboxed environments or virtual machines that do not contain sensitive user data or system configurations.

Public Exploit Available: Yes, a public proof-of-concept exists via the GitHub repository frawlaboy/CVE-2026-39973-PoC.

The presence of a functional proof-of-concept combined with the potential for remote code execution necessitates immediate action. Security teams must ensure that all instances of Apktool are upgraded to version 3.0.2 to close this security regression and prevent potential host system compromise.