iBotPeaches/Apktool · critical · SecurityException

Malicious value for apkFileName: " + mApkFileName

Error message

Malicious value for apkFileName: " + mApkFileName

What it means

SecurityException thrown while parsing apktool.yml during rebuild: the apkFileName field must be a plain filename. The values '.', '..', or anything containing '/' or '\' are rejected because apkFileName is used to construct the output APK path inside the destination — allowing path separators would let a crafted project write outside the output directory (path traversal / Zip Slip style attack). This guards against malicious apktool.yml in third-party decompiled projects.

Source

Thrown at brut.apktool/apktool-lib/src/main/java/brut/androlib/meta/ApkInfo.java:110

            write(writer);
        } catch (IOException ex) {
            throw new AndrolibException(ex);
        }
    }

    @Override
    public void readItem(YamlReader reader) {
        YamlLine line = reader.getLine();
        switch (line.getKey()) {
            case "version":
                mVersion = line.getValue();
                break;
            case "apkFileName":
                mApkFileName = line.getValue();
                // Sanity check for potential malicious input.
                if (mApkFileName.equals(".") || mApkFileName.equals("..") || mApkFileName.indexOf('/') != -1
                        || mApkFileName.indexOf('\\') != -1) {
                    throw new SecurityException("Malicious value for apkFileName: " + mApkFileName);
                }
                break;
            case "usesFramework":
                mUsesFramework.clear();
                reader.readObject(mUsesFramework);
                break;
            case "usesLibrary":
                mUsesLibrary.clear();
                reader.readStringList(mUsesLibrary);
                break;
            case "sdkInfo":
                mSdkInfo.clear();
                reader.readObject(mSdkInfo);
                break;
            case "versionInfo":
                mVersionInfo.clear();
                reader.readObject(mVersionInfo);
                break;

View on GitHub (pinned to 79b63384d7)

Solutions

1. Open apktool.yml in the project root and set apkFileName to a bare filename with no directory components, e.g. `apkFileName: app.apk`.
2. If you did not edit it, treat the project as untrusted and re-decode from the original APK.
3. Audit the project for other tampered metadata before building.

Example fix

# before (apktool.yml)
apkFileName: ../../../../tmp/evil.apk
# after (apktool.yml)
apkFileName: app.apk

// Before build, sanitize apkFileName from apktool.yml
String name = apkInfo.getApkFileName();
if (".".equals(name) || "..".equals(name)
        || name.indexOf('/') != -1 || name.indexOf('\\') != -1) {
    apkInfo.setApkFileName("rebuilt.apk");
}

boolean isSafeApkFileName(String n) {
    return n != null && !n.isEmpty() && !n.equals(".") && !n.equals("..")
            && n.indexOf('/') == -1 && n.indexOf('\\') == -1;
}

catch (SecurityException e) { /* treat project as untrusted; abort build, do not 'fix' silently */ }

When it happens

Trigger: Decoding a project (or hand-editing apktool.yml) so that apkFileName is `../../evil.apk`, `..\..\evil.apk`, `.`, or `..`, then building it: ApkInfo.readItem() rejects the value immediately when the yaml line is read.

Common situations: Building a decompiled APK downloaded from an untrusted source that was tampered with; manually renaming the apk in apktool.yml using a path instead of a bare name; security tooling that mutates apkFileName during fuzzing.

Related errors

• aapt2 binaries are not available for 32-bit platforms.
• Could not identify platform: " + OSDetection.returnOS()
• Could not read aapt binary: " + binFile.getPath()
• Could not set aapt binary as executable:
• Could not execute aapt binary at location:

AI-assisted analysis of iBotPeaches/Apktool@79b63384d7 (2026-08-14). Data as JSON: /api/errors/1cb2a1ad30b457cb. Report an issue: GitHub.