CVE-2026-54684

Name of the Vulnerable Software and Affected Versions jadx versions 1.5.2 through 1.5.5

Description A path traversal issue exists where a malicious .xapk file can cause the application to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory. This occurs because the XApkLoader resolves each entry name directly using tmpDir.resolve(fileName) after a CWD-based ZIP security check. If the application is launched from a directory that is an ancestor of the config directory, this arbitrary write can be used to place a JAR file in plugins/dropins. Subsequently, the next execution loads the JAR via URLClassLoader and ServiceLoader, leading to the execution of attacker-controlled plugin code.

Recommendations Update to version 1.5.6.