EUVD-2026-61131
GHSA-x768-8642-mmq9
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Any API key holder (not only admins) can upload files, warranting PR:L; no confidentiality or integrity impact is present.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.py logs that an archive member exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE is being skipped but does not continue to the next member, so an authenticated user can upload a crafted ZIP or APK whose oversized member is extracted to disk when the aggregate ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE limit has not yet been reached, potentially exhausting disk space and preventing further scans. This issue is fixed in version 4.5.1.
AnalysisAI
Disk exhaustion via zip bomb bypass in MobSF prior to 4.5.1 allows any authenticated user to trigger uncontrolled resource consumption by uploading a crafted ZIP or APK whose member file exceeds 400 MB. The extraction function in shared_func.py logs a 'Skipping' warning but omits the continue statement, causing the oversized member to be written to disk regardless of the per-file size guard. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid MobSF API key or authenticated session - unauthenticated external attackers cannot trigger this without first obtaining credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 4.9 with PR:H reflects the authentication barrier, which appropriately limits exposure to users who already hold a valid MobSF API key. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to MobSF version 4.5.1, which corrects the missing continue statement in the per-file size check via commit 62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf (PR #2627 at https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary file read via path traversal in MobSF prior to 4.5.1 allows authenticated users with scan-upload permissions t
Cross-site request forgery in MobSF prior to 4.5.1 enables a remote attacker to perform destructive authenticated action
SSRF port restriction bypass in MobSF (Mobile Security Framework) prior to 4.5.1 allows authenticated high-privilege use
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today