https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:27:12 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-09278 bdu:2025-09278 https://cve.radiocsirt.org/vuln/bdu:2025-09278 https://cve.radiocsirt.org/vuln/euvd-2026-237671 EUVD-2026-237671 https://cve.radiocsirt.org/vuln/euvd-2026-237671 https://cve.radiocsirt.org/vuln/fkie_cve-2025-46335 <p>Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting (XSS) vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG files during the Android APK analysis workflow. Version 4.3.3 fixes the issue.</p> <p>Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting (XSS) vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG files during the Android APK analysis workflow. Version 4.3.3 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-46335 https://cve.radiocsirt.org/vuln/ghsa-mwfg-948f-2cc5 <p><strong>Affected:</strong> PyPI: mobsf</p> <p>**Vulnerable MobSF Versions:** &lt;= v4.3.2</p> <p>**CVSS V4.0 Score:** 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N)</p> <p>**Details:** A Stored Cross-Site Scripting (XSS) vulnerability has been identified in MobSF versions ≤ 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG files during the Android APK analysis workflow.</p> <p>When an Android Studio project contains a malicious SVG file as an app icon (e.g path, /app/src/main/res/mipmap-hdpi/ic_launcher.svg), and the project is zipped and uploaded to MobSF, the tool processes and extracts the contents without validating or sanitizing the SVG.</p> <p>Upcon ZIP extraction this icon file is saved by MobSF to: user/.MobSF/downloads/&lt;filename&gt;.svg</p> <p>This file becomes publicly accessible via the web interface at:</p> <p>http://127.0.0.1:8081/download/filename.svg</p> <p>If the SVG contains embedded JavaScript (e.g., an XSS payload), accessing this URL via a browser leads to the execution of the script in the context of the MobSF user session, resulting in stored XSS.</p> <p>**Proof Of Concept:**</p> <p>1. Create a malicious SVG file (ic_launcher.svg) with an embedded XSS payload.</p> <p></p> <p>2. Place the file in the Android Studio project directory: /app/src/main/res/mipmap-hdpi/ic_launcher.svg</p> <p></p> <p>3. Zip the project directory and upload it to MobSF.</p> <p></p> <p>**Details:** A Stored Cross-Site Scripting (XSS) vulnerability has been identified in MobSF versions ≤ 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG files during the Android APK analysis workflow.</p> <p>When an Android Studio project contains a malicious SVG file as an app icon (e.g path, /app/src/main/res/mipmap-hdpi/ic_launcher.svg), and the project is zipped and uploaded to MobSF, the tool processes and extracts the contents without validating or sanitizing the SVG.</p> <p>Upcon ZIP extraction this icon file is saved by MobSF to: user/.MobSF/downloads/&lt;filename&gt;.svg</p> <p>This file becomes publicly accessible via the web interface at:</p> <p>http://127.0.0.1:8081/download/filename.svg</p> <p>If the SVG contains embedded JavaScript (e.g., an XSS payload), accessing this URL via a browser leads to the execution of the script in the context of the MobSF user session, resulting in stored XSS.</p> <p>**Proof Of Concept:**</p> <p>1. Create a malicious SVG file (ic_launcher.svg) with an embedded XSS payload.</p> <p></p> <p>2. Place the file in the Android Studio project directory: /app/src/main/res/mipmap-hdpi/ic_launcher.svg</p> <p></p> <p>3. Zip the project directory and upload it to MobSF.</p> <p></p> <p>**Details:** A Stored Cross-Site Scripting (XSS) vulnerability has been identified in MobSF versions ≤ 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG files during the Android APK analysis workflow.</p> <p>When an Android Studio project contains a malicious SVG file as an app icon (e.g path, /app/src/main/res/mipmap-hdpi/ic_launcher.svg), and the project is zipped and uploaded to MobSF, the tool processes and extracts the contents without validating or sanitizing the SVG.</p> <p>Upcon ZIP extraction this icon file is saved by MobSF to: user/.MobSF/downloads/&lt;filename&gt;.svg</p> <p>This file becomes publicly accessible via the web interface at:</p> <p>http://127.0.0.1:8081/download/filename.svg</p> <p>If the SVG contains embedded JavaScript (e.g., an XSS payload), accessing this URL via a browser leads to the execution of the script in the context of the MobSF user session, resulting in stored XSS.</p> <p>**Proof Of Concept:**</p> <p>1. Create a malicious SVG file (ic_launcher.svg) with an embedded XSS payload.</p> <p></p> <p>2. Place the file in the Android Studio project directory: /app/src/main/res/mipmap-hdpi/ic_launcher.svg</p> <p></p> <p>3. Zip the project directory and upload it to MobSF.</p> <p></p> <p>**Details:** A Stored Cross-Site Scripting (XSS) vulnerability has been identified in MobSF versions ≤ 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG files during the Android APK analysis workflow.</p> <p>When an Android Studio project contains a malicious SVG file as an app icon (e.g path, /app/src/main/res/mipmap-hdpi/ic_launcher.svg), and the project is zipped and uploaded to MobSF, the tool processes and extracts the contents without validating or sanitizing the SVG.</p> <p>Upcon ZIP extraction this icon file is saved by MobSF to: user/.MobSF/downloads/&lt;filename&gt;.svg</p> <p>This file becomes publicly accessible via the web interface at:</p> <p>http://127.0.0.1:8081/download/filename.svg</p> <p>If the SVG contains embedded JavaScript (e.g., an XSS payload), accessing this URL via a browser leads to the execution of the script in the context of the MobSF user session, resulting in stored XSS.</p> <p>**Proof Of Concept:**</p> <p>1. Create a malicious SVG file (ic_launcher.svg) with an embedded XSS payload.</p> <p></p> <p>2. Place the file in the Android Studio project directory: /app/src/main/res/mipmap-hdpi/ic_launcher.svg</p> <p></p> <p>3. Zip the project directory and upload it to MobSF.</p> <p>![03](https:…</p> https://cve.radiocsirt.org/vuln/pysec-2026-1675