CVE-2026-68922: MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads
The find_icon_path_zip() function in MobSF does not properly sanitize the android:icon attribute extracted from an Android manifest before resolving it as a filesystem path.
An attacker can supply a malicious android:icon value containing path traversal sequences, causing MobSF to read arbitrary files from the server filesystem and copy them into the downloads directory (DWD_DIR). These files can then be retrieved by any authenticated user via the /download/<filename> endpoint, provided the file extension is included in ALLOWED_EXTENSIONS.
References
- github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf
- github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627
- github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1
- github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8j49-mmcx-4mp5
- github.com/advisories/GHSA-8j49-mmcx-4mp5
- nvd.nist.gov/vuln/detail/CVE-2026-68922
Code Behaviors & Features
Detect and mitigate CVE-2026-68922 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →