CVE-2026-68922: MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads
The find_icon_path_zip() function in MobSF does not properly sanitize the android:icon attribute extracted from an Android manifest before resolving it as a filesystem path.
An attacker can supply a malicious android:icon value containing path traversal sequences, causing MobSF to read arbitrary files from the server filesystem and copy them into the downloads directory (DWD_DIR). These files can then be retrieved by any authenticated user via the /download/<filename> endpoint, provided the file extension is included in ALLOWED_EXTENSIONS.
References
- github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf
- github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627
- github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1
- github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8j49-mmcx-4mp5
- github.com/advisories/GHSA-8j49-mmcx-4mp5
- nvd.nist.gov/vuln/detail/CVE-2026-68922
Code Behaviors & Features
Detect and mitigate CVE-2026-68922 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →