CVE-2026-54684 Details
Description
jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolve(fileName) after a CWD-based ZIP security check. When jadx is launched from a directory that is an ancestor of the config directory, the arbitrary write can plant a JAR in plugins/dropins, and the next jadx run loads the JAR with URLClassLoader and ServiceLoader, executing attacker-controlled plugin code. This issue is fixed in version 1.5.6.
A vulnerability in jadx versions 1.5.2 through 1.5.5 allows a malicious .xapk file to cause arbitrary file overwriting. This occurs because the XApkLoader resolves ZIP entry names directly to the temporary directory after a security check, potentially leading to exploitation. When jadx is launched from a directory that is an ancestor of the config directory, this vulnerability can be exploited to execute arbitrary code by planting a JAR file in the plugins/dropins directory, which is loaded as a plugin on the next run of jadx.
Users can update to jadx version 1.5.6, which addresses this vulnerability by rejecting absolute paths and normalizing entry names before extraction.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 14, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/skylot/jadx/security/advisories/GHSA-gpvc-ccw7-744v | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/skylot/jadx/commit/a74bb07d6eebaf4da5c2b2cbc4d3c0c3cb7517cb | [email protected] | Source CodeVendor |
| https://github.com/skylot/jadx/releases/tag/v1.5.6 | [email protected] | Release NotesVendor |
| https://github.com/skylot/jadx/security/advisories/GHSA-gpvc-ccw7-744v | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| skylot jadx | >= 1.5.2, <= 1.5.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |