{"record":{"id":"1cb2a1ad30b457cb","repo":"iBotPeaches/Apktool","slug":"malicious-value-for-apkfilename-mapkfilename","errorCode":null,"errorMessage":"Malicious value for apkFileName: \" + mApkFileName","messagePattern":"Malicious value for apkFileName: \" \\+ mApkFileName","errorType":"exception","errorClass":"SecurityException","httpStatus":null,"severity":"critical","filePath":"brut.apktool/apktool-lib/src/main/java/brut/androlib/meta/ApkInfo.java","lineNumber":110,"sourceCode":"            write(writer);\n        } catch (IOException ex) {\n            throw new AndrolibException(ex);\n        }\n    }\n\n    @Override\n    public void readItem(YamlReader reader) {\n        YamlLine line = reader.getLine();\n        switch (line.getKey()) {\n            case \"version\":\n                mVersion = line.getValue();\n                break;\n            case \"apkFileName\":\n                mApkFileName = line.getValue();\n                // Sanity check for potential malicious input.\n                if (mApkFileName.equals(\".\") || mApkFileName.equals(\"..\") || mApkFileName.indexOf('/') != -1\n                        || mApkFileName.indexOf('\\\\') != -1) {\n                    throw new SecurityException(\"Malicious value for apkFileName: \" + mApkFileName);\n                }\n                break;\n            case \"usesFramework\":\n                mUsesFramework.clear();\n                reader.readObject(mUsesFramework);\n                break;\n            case \"usesLibrary\":\n                mUsesLibrary.clear();\n                reader.readStringList(mUsesLibrary);\n                break;\n            case \"sdkInfo\":\n                mSdkInfo.clear();\n                reader.readObject(mSdkInfo);\n                break;\n            case \"versionInfo\":\n                mVersionInfo.clear();\n                reader.readObject(mVersionInfo);\n                break;","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/iBotPeaches/Apktool/blob/79b63384d7d7e22917e6ea8b453272da7012515b/brut.apktool/apktool-lib/src/main/java/brut/androlib/meta/ApkInfo.java#L92-L128","documentation":"SecurityException thrown while parsing apktool.yml during rebuild: the apkFileName field must be a plain filename. The values '.', '..', or anything containing '/' or '\\' are rejected because apkFileName is used to construct the output APK path inside the destination — allowing path separators would let a crafted project write outside the output directory (path traversal / Zip Slip style attack). This guards against malicious apktool.yml in third-party decompiled projects.","triggerScenarios":"Decoding a project (or hand-editing apktool.yml) so that apkFileName is `../../evil.apk`, `..\\..\\evil.apk`, `.`, or `..`, then building it: ApkInfo.readItem() rejects the value immediately when the yaml line is read.","commonSituations":"Building a decompiled APK downloaded from an untrusted source that was tampered with; manually renaming the apk in apktool.yml using a path instead of a bare name; security tooling that mutates apkFileName during fuzzing.","solutions":["Open apktool.yml in the project root and set apkFileName to a bare filename with no directory components, e.g. `apkFileName: app.apk`.","If you did not edit it, treat the project as untrusted and re-decode from the original APK.","Audit the project for other tampered metadata before building."],"exampleFix":"# before (apktool.yml)\napkFileName: ../../../../tmp/evil.apk\n# after (apktool.yml)\napkFileName: app.apk","handlingStrategy":"validation","validationCode":"// Before build, sanitize apkFileName from apktool.yml\nString name = apkInfo.getApkFileName();\nif (\".\".equals(name) || \"..\".equals(name)\n        || name.indexOf('/') != -1 || name.indexOf('\\\\') != -1) {\n    apkInfo.setApkFileName(\"rebuilt.apk\");\n}","typeGuard":"boolean isSafeApkFileName(String n) {\n    return n != null && !n.isEmpty() && !n.equals(\".\") && !n.equals(\"..\")\n            && n.indexOf('/') == -1 && n.indexOf('\\\\') == -1;\n}","tryCatchPattern":"catch (SecurityException e) { /* treat project as untrusted; abort build, do not 'fix' silently */ }","preventionTips":["Only build decompiled projects from trusted sources.","Treat a SecurityException from ApkInfo as evidence of tampering, not a bug to work around."],"tags":["apktool","security","path-traversal","yaml","build"],"backgroundTag":null,"analyzedSha":"79b63384d7d7e22917e6ea8b453272da7012515b","analyzedAt":"2026-08-14T10:43:28.812Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}