CVE-2026-104585

Deferred Deferred - Pending Action

Command Injection in Mobile Security Framework

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: MITRE

Description

Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104585

EUVD

EUVD-2026-100603

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-104585 is a command injection and arbitrary file write vulnerability in Mobile Security Framework (MobSF) v4.5.2. It occurs when MobSF extracts and uses an attacker-controlled package name from an uploaded APK's AndroidManifest.xml without proper validation. This allows malicious payloads to be injected into commands like 'adb pull' or 'adb shell', leading to path traversal and remote command execution on the MobSF host and connected Android VM.

Detection Guidance

Check MobSF logs for suspicious ADB commands or file operations during dynamic analysis. Inspect AndroidManifest.xml in uploaded APKs for malformed package attributes containing shell metacharacters like semicolons or command substitutions.

Impact Analysis

An attacker could upload a malicious APK with a crafted package name to execute arbitrary commands on your MobSF server and Android VM. This could result in unauthorized file creation, data theft, or full system compromise. Attackers might gain control over your analysis environment or use it as a foothold to attack other systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. If exploited, it may result in data breaches, unauthorized processing, or loss of audit trails, potentially leading to regulatory penalties or legal consequences.

Mitigation Strategies

Upgrade MobSF to a patched version. Validate and sanitize package names from AndroidManifest.xml before processing. Disable dynamic analysis until patched. Monitor for unauthorized file creation or ADB command execution.

Hi! I’m here to help you understand CVE-2026-104585. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70