CVE-2026-68922: MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads
MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment, allowing an authenticated user to upload a crafted ZIP or APK that reads a server file with an ALLOWEDEXTENSIONS suffix, copies it to DWDDIR as the predictable name -icon., and retrieves it through the /download/ endpoint. The same behavior provides a file-existence oracle through the iconpath report field. This issue is fixed in version 4.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MobSFto a version that resolves this vulnerability.Fixed in 4.5.1
Event History
Frequently Asked Questions
Who can exploit this issue?
MobSF instances prior to 4.5.1 are affected if an authenticated user can upload a crafted ZIP or APK for analysis. Exploitation does not require user interaction, but it does require high privileges.
What conditions are required to read a server file?
An attacker needs to control the Android manifest android:icon value in an uploaded ZIP or APK. The targeted server file must have an extension allowed by MobSF's ALLOWED_EXTENSIONS setting.
What is the remediation?
Upgrade MobSF to version 4.5.1. The provided data does not describe an alternative mitigation for environments that cannot immediately upgrade.
How could exploitation be identified?
A successful exploit can copy a readable eligible file into DWD_DIR using the predictable filename -icon. and make it retrievable through the /download/ endpoint. The icon_path report field can also be used as a file-existence oracle.