MobSF CVE-2026-104585

Exploitation targets three specific MobSF v4.5.2 code paths: the /download_data/ endpoint, the /api/v1/scan REST endpoint, and the Dynamic Analyzer Android ADB integration module (tests_common.py), where user-controlled input reaches a shell command. Concrete prerequisites: for /api/v1/scan the attacker needs network access to the MobSF instance plus a valid MobSF REST API key (MobSF enforces API-key authorization on /api/v1 by default), and for the ADB integration path a dynamic-analysis environment with a connected/configured Android emulator or device must be active. Limiting factors: MobSF is typically deployed as an internal security-testing tool behind the corporate network rather than internet-facing, and the API-key requirement likely contradicts the input's PR:N - both substantially reduce the unauthenticated-remote exposure implied by the 9.8 score.

The input CVSS of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this as critical, reflecting network-reachable, low-complexity command injection yielding full confidentiality, integrity, and availability loss. However, the real-world signals temper that score: EPSS is only 0.71% (52nd percentile), which is low for a 9.8, and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation. A public exploit/POC repository exists (AmalJafarzade/CVE-2026-104585), raising the practical likelihood that someone with access could weaponize it. There is a tension worth verifying: the input vector asserts PR:N (unauthenticated), yet MobSF's /api/v1/ endpoints normally require a REST API key, so at least the /api/v1/scan vector is likely authenticated - verify the PR:N claim with the vendor/source, because it materially changes exposure. No SSVC decision data (exploitation/automatable/technical-impact) was provided in the input, so an SSVC-based prioritization cannot be computed here. Net: a genuinely high-impact RCE-class flaw with public POC, but low observed exploitation probability and likely some access/auth prerequisite - treat as high priority to patch where MobSF is network-exposed, but not an emergency 'actively exploited' scenario.

An attacker who can reach the MobSF web interface or holds a valid MobSF API key submits a crafted request to /download_data/, /api/v1/scan, or triggers the Dynamic Analyzer ADB integration with attacker-controlled input that is passed unsanitized into a shell command (CWE-77), resulting in arbitrary OS command execution on the MobSF host. Public exploit code is available in the referenced GitHub POC repository, lowering the skill barrier. Given CVSS AV:N/AC:L, the request can be delivered remotely over the network with low complexity once the attacker has the necessary access.