CVE-2026-68922 in Mobile-Security-Framework-MobSF
Summary
by MITRE • 08/18/2026
MobSF is a mobile application security testing tool used. Prior to 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment, allowing an authenticated user to upload a crafted ZIP or APK that reads a server file with an ALLOWED_EXTENSIONS suffix, copies it to DWD_DIR as the predictable name -icon., and retrieves it through the /download/ endpoint. The same behavior provides a file-existence oracle through the icon_path report field. This issue is fixed in version 4.5.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified involves a path traversal flaw within MobSF, specifically affecting versions prior to 4.5.1. As a widely used mobile application security testing tool, MobSF processes uploaded Android Package Kit files and ZIP archives for static analysis. The core technical deficiency resides in the find_icon_path_zip function located in the mobsf/StaticAnalyzer/views/android/icon_analysis.py module. This component is responsible for locating icon resources within the analyzed package by parsing the android:icon attribute from the application manifest file. Instead of validating that the extracted path remains confined to the intended scan resource directory, the implementation directly uses this untrusted input to construct filesystem paths.
This lack of validation allows an authenticated user to craft a malicious ZIP or APK archive containing a specially designed android:icon value with directory traversal sequences such as ../../../../etc/passwd. When MobSF processes this artifact, it interprets these sequences literally and resolves the path outside the designated temporary scan directory. Consequently, if the target file possesses one of the ALLOWED_EXTENSIONS suffixes, the system proceeds to copy the external server file into the DWD_DIR using a predictable naming convention that appends -icon to the filename. This mechanism effectively bypasss isolation boundaries intended to prevent access to sensitive host files.
The operational impact of this vulnerability is significant for environments where MobSF instances are accessible to multiple users or have elevated privileges on the underlying operating system. An attacker can exploit this flaw to read arbitrary server files that match specific extension criteria, leading to unauthorized data disclosure. Furthermore, because the application generates a report containing the icon_path field regardless of whether the file retrieval succeeds, it inadvertently creates a file-existence oracle. This secondary effect allows attackers to enumerate sensitive paths on the host system by observing variations in response behavior or error messages associated with existing versus non-existing files, thereby facilitating further reconnaissance and targeted attacks against other services running on the same infrastructure.
From a classification perspective, this issue aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, as the application fails to restrict file access to expected directories. Additionally, it relates to CWE-209 Generation of Error Message Containing Sensitive Information due to the potential leakage of path existence data through report fields. In terms of attack vectors, this vulnerability can be leveraged within the context of ATT&CK technique T1537 Transfer Data to Cloud Account or local file inclusion scenarios where an authenticated user seeks to escalate privileges or exfiltrate configuration files and credentials stored on the server hosting MobSF.
Mitigation strategies primarily involve upgrading to version 4.5.1 or later, which addresses these path validation deficiencies by implementing strict containment checks before processing icon paths. For organizations unable to upgrade immediately, deploying a web application firewall with rules capable of detecting directory traversal patterns in uploaded manifest files can provide temporary protection. Additionally, restricting the ALLOWED_EXTENSIONS list to only those strictly necessary for mobile analysis and ensuring that DWD_DIR is located outside any publicly accessible or sensitive system directories reduces the blast radius should an exploit be attempted. Regular auditing of file upload handlers and enforcing strict input validation on all metadata extracted from archives are essential practices to prevent similar path traversal vulnerabilities in security testing tools.