debian/apktool vulnerabilities

Latest debian/apktool CVEs

Newest publication first

1. CVE-2026-39973 Apktool: Path Traversal to Arbitrary File Write

   Published 2026-04-21

   High·CVSS 7.1 EPSS 0.18%

   Apktool is a tool for reverse engineering Android APK files. In versions 3.0.0 and 3.0.1, a path traversal vulnerability in brut/androlib/res/decoder/ResFileDecoder.java allows a maliciously crafted APK to write arbitrary files to the filesystem during standard decoding (apktool...

2. CVE-2024-21633 Arbitrary file write on Decoding

   Published 2024-01-03

   High·CVSS 7.8 EPSS 1.3%

   Apktool is a tool for reverse engineering Android APK files. In versions 2.9.1 and prior, Apktool infers resource files' output path according to their resource names which can be manipulated by attacker to place files at desired location on the system Apktool runs on. Affected e...

3. CVE-2017-8315 Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier was found vulnerable to an XML External Entity attack. An attacker can exploit the vulnerability by implementing malicious code on....

   Published 2018-04-20

   High·CVSS 7.5 EPSS 1.6%

   Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier was found vulnerable to an XML External Entity attack. An attacker can exploit the vulnerability by implementing malicious code on Androidmanifest.xml.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.