Threat Intelligence Database

MobSF is a mobile application security testing tool used. Prior to 4.5.1, get_browsable_activities in mobsf/StaticAnalyzer/views/android/manifest_analysis.py validates only an Android manifest android:host value with valid_host before appending a separately supplied android:port to the URL fetched by _check_url, allowing an authenticated user to upload a crafted APK that makes requests to an attacker-selected nonstandard port at /.well-known/assetlinks.json. With an attacker-controlled hostname and DNS rebinding between validation and the requests.get connection, the request can reach an internal service, although redirects remain disabled and the path is fixed. This issue is fixed in version 4.5.1.

CVE-2026-68924 is a medium severity vulnerability in MobSF Mobile-Security-Framework prior to version 4.5.1. It involves uncontrolled resource consumption due to improper handling of oversized archive members during ZIP extraction. An authenticated user can upload a crafted ZIP or APK file with an oversized member that bypasses the intended size check, leading to disk space exhaustion and denial of service by preventing further scans. This issue is fixed in version 4.5.1.

A Cross-Site Request Forgery (CSRF) vulnerability exists in MobSF Mobile-Security-Framework-MobSF versions prior to 4.5.1 due to improper middleware configuration. This allows remote attackers to trick logged-in users into submitting unauthorized POST requests to sensitive endpoints, potentially leading to unauthorized actions such as deleting scans, uploading or downloading applications, changing passwords, or managing user accounts. The issue is resolved in version 4.5.1.

CVE-2026-68922 is a path traversal vulnerability in MobSF Mobile-Security-Framework-MobSF prior to version 4.5.1. The vulnerability arises from improper validation of the android:icon path in the Android manifest, allowing an authenticated user to upload crafted ZIP or APK files that can read server files with allowed extensions. This can lead to unauthorized file disclosure and a file-existence oracle via the icon_path report field. The issue is fixed in version 4.5.1.