CVE-2026-68924 — MobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

Affected: MobSF Mobile-Security-Framework-MobSF

MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.py logs that an archive member exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE is being skipped but does not continue to the next member, so an authenticated user can upload a crafted ZIP or APK whose oversized member is extracted to disk when the aggregate ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE limit has not yet been reached, potentially exhausting disk space and preventing further scans. This issue is fixed in version 4.5.1.

GHSA-x768-8642-mmq9 — MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

Affected: PyPI: mobsf

### Summary

When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed `ZIP_MAX_UNCOMPRESSED_FILE_SIZE` (400 MB) and logs "Skipping" — but the code lacks a `continue` statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk.

### Verified Impact (Code Audit)

The vulnerable code path in `shared_func.py` lines 153–182:

```python # Line 156: Size check if fileinfo.file_size > settings.ZIP_MAX_UNCOMPRESSED_FILE_SIZE: size_mb = fileinfo.file_size / (1024 * 1024) msg = (f'File too large ({size_mb:.2f} MB). Skipping ' f'{sanitize_for_logging(file_path)}') logger.warning(msg) # ← BUG: No 'continue' here! Execution falls through.

# Line 161: Total size check (separate) if total_size > settings.ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE: raise Exception(msg)

# Line 171-178: Permission fixing (only dirs get 'continue') if fileinfo.is_dir(): continue else: fileinfo.external_attr = ...

# Line 182: EXTRACTION ALWAYS HAPPENS FOR FILES try: zipptr.extract(file_path, ext_path) # ← Runs regardless of size check ```

The control flow is clear: after the size check logs "Skipping", no `continue` or `break` is issued. The code proceeds to line 182 which extracts the file unconditionally.

### Steps to Reproduce

**1.** Create a ZIP/APK with a file exceeding 400 MB (zeros compress very well):

```python #!/usr/bin/env python3 import zipfile, tempfile, os

output = tempfile.mktemp(suffix=…

Most recent entries from all

CVE-2026-68924 — MobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

GHSA-x768-8642-mmq9 — MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction