Most recent entries from all

EUVD-2026-355495

fkie_cve-2026-68922

MobSF is a mobile application security testing tool used. Prior to 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment, allowing an authenticated user to upload a crafted ZIP or APK that reads a server file with an ALLOWED_EXTENSIONS suffix, copies it to DWD_DIR as the predictable name -icon., and retrieves it through the /download/ endpoint. The same behavior provides a file-existence oracle through the icon_path report field. This issue is fixed in version 4.5.1.

GHSA-8j49-mmcx-4mp5 — MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

Affected: PyPI: mobsf

### Summary The `find_icon_path_zip()` function in MobSF does not properly sanitize the `android:icon` attribute extracted from an Android manifest before resolving it as a filesystem path.

An attacker can supply a malicious `android:icon` value containing path traversal sequences, causing MobSF to read arbitrary files from the server filesystem and copy them into the downloads directory (`DWD_DIR`). These files can then be retrieved by any authenticated user via the `/download/<filename>` endpoint, provided the file extension is included in `ALLOWED_EXTENSIONS`.

### Details ``` elif icon_path.startswith(('res/', '/res/')): stripped_relative_path = icon_path.strip('/res') # Works for neither /res nor res full_path = os.path.join(res_dir, stripped_relative_path) if os.path.exists(full_path): return full_path full_path += '.png' if os.path.exists(full_path): return full_path ``` https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/6e875fb77baa9dbe65ff8e7d0344d740e1d6d51e/mobsf/StaticAnalyzer/views/android/icon_analysis.py#L126

This code enables path traversal if a value like 'res/../../../signatures/maltrail-malware-domains.txt' is used as the icon path. This path will resolve to outside the scan directory, and the file will eventually be copied into `DWD_DIR/<md5>-icon.<ext>`: ``` icon_file = find_icon_path_zip( app_dic['md5'], res_path, icon_from_mfst) if icon_file and Path(icon_file).exists():…

PYSEC-2026-3689 — MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

Affected: PyPI: mobsf

### Summary The `find_icon_path_zip()` function in MobSF does not properly sanitize the `android:icon` attribute extracted from an Android manifest before resolving it as a filesystem path.