EUVD-2026-61133
GHSA-95px-34x5-p37h
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
DNS rebinding required for SSRF pivot mandates AC:H; upload access to MobSF requires high-privilege authentication (PR:H); fixed path and no redirects limit impact to C:L with scope change (S:C) to internal services.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
MobSF is a mobile application security testing tool used. Prior to 4.5.1, get_browsable_activities in mobsf/StaticAnalyzer/views/android/manifest_analysis.py validates only an Android manifest android:host value with valid_host before appending a separately supplied android:port to the URL fetched by _check_url, allowing an authenticated user to upload a crafted APK that makes requests to an attacker-selected nonstandard port at /.well-known/assetlinks.json. With an attacker-controlled hostname and DNS rebinding between validation and the requests.get connection, the request can reach an internal service, although redirects remain disabled and the path is fixed. This issue is fixed in version 4.5.1.
AnalysisAI
SSRF port restriction bypass in MobSF (Mobile Security Framework) prior to 4.5.1 allows authenticated high-privilege users to cause the server to make outbound HTTP requests to attacker-selected non-standard ports by uploading a crafted APK. The get_browsable_activities() function in manifest_analysis.py validates only the android:host attribute via valid_host(), which enforces a 80/443-only port allowlist, but then appends the separately supplied android:port attribute to the assembled URL without re-validating the combined result - enabling port restriction bypass. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a high-privilege authenticated MobSF account with APK upload and analysis permissions - CVSS PR:H confirms this; unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 3.0 with vector AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N accurately captures the constrained risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade MobSF to version 4.5.1 or later using `pip install --upgrade mobsf`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary file read via path traversal in MobSF prior to 4.5.1 allows authenticated users with scan-upload permissions t
Cross-site request forgery in MobSF prior to 4.5.1 enables a remote attacker to perform destructive authenticated action
Disk exhaustion via zip bomb bypass in MobSF prior to 4.5.1 allows any authenticated user to trigger uncontrolled resour
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today