MobSF Mobile-Security-Framework-MobSF versions before 4.5.1 contain a path traversal vulnerability (CWE-22) in the find_icon_path_zip function within mobsf/StaticAnalyzer/views/android/icon_analysis.py. The function uses the android:icon value from the Android manifest to build file paths under the scan resource directory without properly rejecting traversal sequences or verifying that the path remains within the intended directory. An authenticated user can exploit this by uploading a crafted ZIP or APK file that reads arbitrary server files with allowed extensions, copies them to a predictable location (DWD_DIR with a -icon suffix), and retrieves them via the /download/ endpoint. Additionally, the vulnerability allows a file-existence oracle through the icon_path report field. The vulnerability has a CVSS 3.1 base score of 5.5 (medium severity) with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The issue is fixed in version 4.5.1.

An authenticated attacker can read arbitrary files on the server with allowed extensions by exploiting path traversal in the icon path processing. This leads to unauthorized disclosure of sensitive information (high confidentiality impact). The vulnerability also enables a file-existence oracle, which could aid further attacks. Integrity and availability impacts are low or none. There are no known exploits in the wild.

This vulnerability is fixed in MobSF version 4.5.1. Users should upgrade to version 4.5.1 or later to remediate this issue. No other official remediation or temporary fixes are documented. Since this is not a cloud service, remediation depends on user upgrade.