EUVD-2026-61132
GHSA-8j49-mmcx-4mp5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Requires authenticated scan-upload session (PR:H); file read constrained by ALLOWED_EXTENSIONS but yields high confidentiality impact; file copy to DWD_DIR is a minor integrity side-effect (I:L); no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
MobSF is a mobile application security testing tool used. Prior to 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment, allowing an authenticated user to upload a crafted ZIP or APK that reads a server file with an ALLOWED_EXTENSIONS suffix, copies it to DWD_DIR as the predictable name -icon., and retrieves it through the /download/ endpoint. The same behavior provides a file-existence oracle through the icon_path report field. This issue is fixed in version 4.5.1.
AnalysisAI
Arbitrary file read via path traversal in MobSF prior to 4.5.1 allows authenticated users with scan-upload permissions to exfiltrate server-side files by embedding traversal sequences in the android:icon attribute of a crafted AndroidManifest.xml inside a ZIP or APK upload. The vulnerable find_icon_path_zip() function resolves the attacker-controlled icon path without containment checks, copies the target file to a predictable location in DWD_DIR, and exposes it through the /download/ endpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated MobSF session with scan-upload permissions, enforced by the @login_required and @permission_required(Permissions.SCAN) decorators - unauthenticated access is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) accurately reflects the primary gating factor: exploitation requires a legitimately authenticated session with scan-upload privileges, which confines the realistic threat actor to insiders, compromised accounts, or shared-platform users - not anonymous external attackers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade MobSF to version 4.5.1 or later - confirmed fix release per vendor GitHub tag at https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1 and implemented via commit 62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf (PR #2627 at https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-site request forgery in MobSF prior to 4.5.1 enables a remote attacker to perform destructive authenticated action
Disk exhaustion via zip bomb bypass in MobSF prior to 4.5.1 allows any authenticated user to trigger uncontrolled resour
SSRF port restriction bypass in MobSF (Mobile Security Framework) prior to 4.5.1 allows authenticated high-privilege use
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today