What is the CVSS score of CVE-2026-54684?

CVE-2026-54684 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of jadx are affected by CVE-2026-54684?

jadx (Android decompiler) versions 1.5.2-1.5.5 contain a path traversal vulnerability for which publicly available exploit code exists, allowing malicious APK samples to plant and execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-54684?

Within 24 hours, inventory all jadx installations across development and security teams, identify any running versions 1.5.2-1.5.5, and confirm patch availability from the jadx vendor. Within 7 days, apply the vendor-released patch to all affected instances and validate plugin directory functionality. Within 30 days, conduct file-integrity monitoring on jadx plugin directories to detect any unauthorized plugin loads, particularly across reverse-engineering and malware-analysis team environments.

jadx CVE-2026-54684

EUVD-2026-44536 HIGH

Path Traversal (CWE-22)

2026-07-14 security-advisories@github.com

Java Path Traversal

7.0

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local malicious-file vector with required victim interaction (AV:L/UI:R), high complexity from the non-default launch-directory condition and two-run sequence (AC:H), and full code execution (C:H/I:H/A:H).

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 10:34 vuln.today

Analysis Generated

Jul 22, 2026 - 10:34 vuln.today

Patch available

Jul 14, 2026 - 23:20 EUVD

CVE Published

Jul 14, 2026 - 22:17 cve.org

HIGH 7.0

DescriptionCVE.org

jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolve(fileName) after a CWD-based ZIP security check. When jadx is launched from a directory that is an ancestor of the config directory, the arbitrary write can plant a JAR in plugins/dropins, and the next jadx run loads the JAR with URLClassLoader and ServiceLoader, executing attacker-controlled plugin code. This issue is fixed in version 1.5.6.

Articles & Coverage 1

News 5 New Java Vulnerabilities - 1 Critical, 4 High, 1 With POC Jul 15, 2026

AnalysisAI

Arbitrary file write leading to code execution in jadx 1.5.2 through 1.5.5 allows a malicious .xapk sample to escape the XAPK plugin unpack directory and plant a JAR under plugins/dropins, which the next jadx launch loads and executes via URLClassLoader/ServiceLoader. The flaw stems from XApkLoader calling tmpDir.resolve(fileName) after a flawed CWD-based ZIP name check, giving an analyst opening a crafted file a path traversal that escalates to attacker-controlled plugin code. Publicly available exploit code exists (SSVC exploitation: poc) but it is not in CISA KEV, and EPSS is very low at 0.13% (3rd percentile), consistent with a local, user-interaction-gated, high-complexity issue rather than mass exploitation.

Technical ContextAI

jadx is a widely used open-source Dex-to-Java decompiler for Android reverse engineering. XAPK is a ZIP-based Android package bundle; jadx's XApkLoader unpacks entries into a temporary directory before processing. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): JadxZipSecurity validated entry names against the current working directory using CWD.resolve(entryName).normalize(), but XApkLoader then independently called tmpDir.resolve(fileName) with the raw, attacker-controlled entry name. Because the security check was anchored to CWD rather than the actual extraction target, traversal sequences that pass the check still resolve outside tmpDir. The commit fix (a74bb07) hardens JadxZipSecurity to normalize the entry, reject entries that are absolute or already start with CWD, and only then resolve - closing the mismatch that let a validated name escape the unpack directory. The write becomes code execution because jadx auto-loads plugin JARs from plugins/dropins on startup using URLClassLoader and ServiceLoader.

RemediationAI

Vendor-released patch: 1.5.6 - upgrade jadx to 1.5.6 or later, which is the primary and complete fix (release https://github.com/skylot/jadx/releases/tag/v1.5.6, fix commit https://github.com/skylot/jadx/commit/a74bb07d6eebaf4da5c2b2cbc4d3c0c3cb7517cb, advisory https://github.com/skylot/jadx/security/advisories/GHSA-gpvc-ccw7-744v). If you cannot upgrade immediately, reduce exposure by only opening .xapk files from untrusted sources inside a sandbox or disposable VM, and launch jadx from a working directory that is NOT an ancestor of the jadx config directory (e.g. run it from an isolated, unrelated folder) to break the traversal-to-plugin-write path; note this depends on knowing your config directory location and is fragile. As an additional control, audit and clear the plugins/dropins directory before each run and restrict write permissions on the jadx config/plugins directories so a planted JAR cannot be loaded, accepting that this may interfere with legitimate plugin use. These workarounds only narrow the window - patching to 1.5.6 is the durable remediation.