CVE-2026-68924
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
MobSF, a mobile application security testing tool, prior to 4.5.1 contains a vulnerability in the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.py that logs that an archive member exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE is being skipped but does not continue to the next member. An authenticated user can upload a crafted ZIP or APK whose oversized member is extracted to disk when the aggregate ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE limit has not yet been reached, potentially exhausting disk space and preventing further scans. This issue is fixed in version 4.5.1.
Risk Assessment
The risk includes disk space exhaustion, potentially leading to service disruption and inability to perform scans.
Recommendation
It is recommended to upgrade MobSF to version 4.5.1 or later and monitor archive size limits.
Other vulnerabilities in MobSF
See all- CVE-2026-68927Low
Vulnerability in MobSF before version 4.5.1. The get_browsable_activities function in manifest_analysis.py validates only the android:host value, not android:port, allowing an authenticated user to upload a crafted APK that makes requests to an attacker-selected nonstandard port at /.well-known/assetlinks.json. With DNS rebinding, the request can reach an internal service. Fixed in version 4.5.1.
- CVE-2026-68923Medium
MobSF, a mobile application security testing tool, prior to 4.5.1 contains a vulnerability where django.middleware.csrf.CsrfViewMiddleware is placed only in the deprecated MIDDLEWARE_CLASSES setting and omitted from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.
- CVE-2026-68922Medium
MobSF, a mobile application security testing tool, prior to 4.5.1 contains a vulnerability in find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py that uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment. An authenticated user can upload a crafted ZIP or APK that reads a server file with an ALLOWED_EXTENSIONS suffix, copies it to DWD_DIR as the predictable name -icon., and retrieves it through the /download/ endpoint. The same behavior provides a file-existence oracle through the icon_path report field. This issue is fixed in version 4.5.1.
Original NVD description (English source)
MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.py logs that an archive member exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE is being skipped but does not continue to the next member, so an authenticated user can upload a crafted ZIP or APK whose oversized member is extracted to disk when the aggregate ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE limit has not yet been reached, potentially exhausting disk space and preventing further scans. This issue is fixed in version 4.5.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS