MobSF CVE-2026-68922

Exploitation requires an authenticated MobSF session with scan-upload permissions, enforced by the @login_required and @permission_required(Permissions.SCAN) decorators - unauthenticated access is not possible. The target file's extension must appear in MobSF's ALLOWED_EXTENSIONS allowlist; files with disallowed extensions cannot be retrieved via the /download/ endpoint (though they can be detected via the file-existence oracle in icon_path). The attacker must be able to submit Android archive uploads through the MobSF scan interface. No non-default configuration is required beyond normal authenticated access - the vulnerability is present in any default MobSF deployment processing Android APK or ZIP files. Exploitation is constrained by the OS-level file permissions of the MobSF process user; files unreadable by that process cannot be traversed. The deterministic output filename requires the attacker to know or compute the MD5 of their uploaded archive, which is trivially achievable locally before upload.

The CVSS 3.1 score of 5.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) accurately reflects the primary gating factor: exploitation requires a legitimately authenticated session with scan-upload privileges, which confines the realistic threat actor to insiders, compromised accounts, or shared-platform users - not anonymous external attackers. The high confidentiality impact (C:H) is partially offset by the ALLOWED_EXTENSIONS constraint, meaning raw private keys, certificates, or binaries without a whitelisted extension cannot be exfiltrated via the download endpoint, though the file-existence oracle side-channel is unconstrained by extension. No EPSS score was provided in the available data, so probabilistic exploitation likelihood cannot be quantified from this source. No CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis. However, a functional PoC is embedded in the public GHSA advisory, which lowers exploitation effort to near-zero for any authenticated user aware of the issue. MobSF is commonly deployed as a shared internal analysis platform or CI/CD integration node, where multiple team members hold upload permissions, broadening the effective attack surface within the trust boundary. The combination of public PoC, deterministic output filename, and network-accessible download endpoint means that any authenticated user - including contractors or junior analysts - can reliably exfiltrate allowlisted server files without elevated OS privileges beyond the MobSF application account.

An authenticated MobSF user constructs a ZIP archive containing an AndroidManifest.xml in which the android:icon attribute is set to 'res/../../../signatures/maltrail-malware-domains.txt', computes the MD5 of the archive locally, and uploads it through the standard scan interface. MobSF's find_icon_path_zip() resolves the traversal path, finds the target file, and copies it to DWD_DIR as '<md5>-icon.txt'. The attacker immediately retrieves the file contents via GET /download/<md5>-icon.txt. A complete PoC script generating the malicious archive is publicly available in the GHSA-8j49-mmcx-4mp5 advisory.