https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T03:08:58.450464+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-68922 CVE-2026-68922 — MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads 2026-10-03T03:08:58.482487+00:00

Affected: MobSF Mobile-Security-Framework-MobSF

MobSF is a mobile application security testing tool used. Prior to 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment, allowing an authenticated user to upload a crafted ZIP or APK that reads a server file with an ALLOWED_EXTENSIONS suffix, copies it to DWD_DIR as the predictable name -icon., and retrieves it through the /download/ endpoint. The same behavior provides a file-existence oracle through the icon_path report field. This issue is fixed in version 4.5.1.

 https://cve.radiocsirt.org/vuln/ghsa-8j49-mmcx-4mp5 GHSA-8j49-mmcx-4mp5 — MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads 2026-10-03T03:08:58.482553+00:00

Affected: PyPI: mobsf

### Summary The `find_icon_path_zip()` function in MobSF does not properly sanitize the `android:icon` attribute extracted from an Android manifest before resolving it as a filesystem path.

An attacker can supply a malicious `android:icon` value containing path traversal sequences, causing MobSF to read arbitrary files from the server filesystem and copy them into the downloads directory (`DWD_DIR`). These files can then be retrieved by any authenticated user via the `/download/<filename>` endpoint, provided the file extension is included in `ALLOWED_EXTENSIONS`.

### Details ``` elif icon_path.startswith(('res/', '/res/')): stripped_relative_path = icon_path.strip('/res') # Works for neither /res nor res full_path = os.path.join(res_dir, stripped_relative_path) if os.path.exists(full_path): return full_path full_path += '.png' if os.path.exists(full_path): return full_path ``` https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/6e875fb77baa9dbe65ff8e7d0344d740e1d6d51e/mobsf/StaticAnalyzer/views/android/icon_analysis.py#L126

This code enables path traversal if a value like 'res/../../../signatures/maltrail-malware-domains.txt' is used as the icon path. This path will resolve to outside the scan directory, and the file will eventually be copied into `DWD_DIR/<md5>-icon.<ext>`: ``` icon_file = find_icon_path_zip( app_dic['md5'], res_path, icon_from_mfst) if icon_file and Path(icon_file).exists():…