CVE-2026-68927
LowCVSS 3.0Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Vulnerability in MobSF before version 4.5.1. The get_browsable_activities function in manifest_analysis.py validates only the android:host value, not android:port, allowing an authenticated user to upload a crafted APK that makes requests to an attacker-selected nonstandard port at /.well-known/assetlinks.json. With DNS rebinding, the request can reach an internal service. Fixed in version 4.5.1.
Risk Assessment
Risk of unauthorized access to internal services. An attacker may exploit the vulnerability to probe internal infrastructure.
Recommendation
Update MobSF to version 4.5.1 or later. Restrict access to the tool and monitor uploaded APK files.
Other vulnerabilities in MobSF
See all- CVE-2026-68924Medium
MobSF, a mobile application security testing tool, prior to 4.5.1 contains a vulnerability in the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.py that logs that an archive member exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE is being skipped but does not continue to the next member. An authenticated user can upload a crafted ZIP or APK whose oversized member is extracted to disk when the aggregate ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE limit has not yet been reached, potentially exhausting disk space and preventing further scans. This issue is fixed in version 4.5.1.
- CVE-2026-68923Medium
MobSF, a mobile application security testing tool, prior to 4.5.1 contains a vulnerability where django.middleware.csrf.CsrfViewMiddleware is placed only in the deprecated MIDDLEWARE_CLASSES setting and omitted from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.
- CVE-2026-68922Medium
MobSF, a mobile application security testing tool, prior to 4.5.1 contains a vulnerability in find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py that uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment. An authenticated user can upload a crafted ZIP or APK that reads a server file with an ALLOWED_EXTENSIONS suffix, copies it to DWD_DIR as the predictable name -icon., and retrieves it through the /download/ endpoint. The same behavior provides a file-existence oracle through the icon_path report field. This issue is fixed in version 4.5.1.
Original NVD description (English source)
MobSF is a mobile application security testing tool used. Prior to 4.5.1, get_browsable_activities in mobsf/StaticAnalyzer/views/android/manifest_analysis.py validates only an Android manifest android:host value with valid_host before appending a separately supplied android:port to the URL fetched by _check_url, allowing an authenticated user to upload a crafted APK that makes requests to an attacker-selected nonstandard port at /.well-known/assetlinks.json. With an attacker-controlled hostname and DNS rebinding between validation and the requests.get connection, the request can reach an internal service, although redirects remain disabled and the path is fixed. This issue is fixed in version 4.5.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS