MobSF Mobile-Security-Framework-MobSF versions before 4.5.1 contain a CWE-22 path traversal vulnerability in the find_icon_path_zip function located in mobsf/StaticAnalyzer/views/android/icon_analysis.py. The function improperly constructs file paths using the android:icon attribute from the Android manifest without rejecting traversal sequences or verifying that the path remains within the intended scan resource directory. An authenticated attacker can exploit this by uploading a specially crafted ZIP or APK file to read arbitrary server files with allowed extensions, copy them to a predictable download directory as a file named with the suffix '-icon.', and then retrieve these files through the /download/ endpoint. Additionally, the vulnerability allows an attacker to confirm the existence of files via the icon_path report field. The vulnerability has a CVSS 3.1 score of 5.5 (medium severity) and was fixed in MobSF version 4.5.1.

An authenticated user can exploit this vulnerability to read arbitrary files on the server that have allowed extensions, potentially exposing sensitive information. The attacker can also confirm the existence of files on the server, which may aid further attacks. The integrity impact is limited to information disclosure (partial), and availability is not affected.

This vulnerability is fixed in MobSF version 4.5.1. Users should upgrade to version 4.5.1 or later to remediate this issue. No additional mitigation steps are required once the upgrade is applied.