A path traversal flaw in Apktool versions 3.0.0 and 3.0.1 allows a maliciously crafted APK to write files outside the intended output directory. By inserting "../" sequences into the resource file, the decoder can overwrite arbitrary files such as ~/.ssh/config, ~/.bashrc, or Windows startup programs, potentially leading to remote code execution. The vulnerability is a classic filesystem traversal error (CWE-22).

The vulnerability affects the Apktool project by iBotPeaches. The affected releases are 3.0.0 and 3.0.1. The advisory indicates that version 3.0.2 addresses the issue by restoring path sanitization before file writes.

The CVSS score of 7.1 denotes significant risk. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog, indicating no known active exploitation at this time. Exploitation requires the attacker to supply a malicious APK and execute apktool's decode command locally; therefore the threat is primarily local or within an environment where influenced users run apktool. The flaw could be mitigated by applying the patch or abstracting the decoding process so that untrusted files are never processed.