CVE-2026-68922
Received Received - Intake

Path Traversal in MobSF Prior to 4.5.1

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MobSF is a mobile application security testing tool used. Prior to 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment, allowing an authenticated user to upload a crafted ZIP or APK that reads a server file with an ALLOWED_EXTENSIONS suffix, copies it to DWD_DIR as the predictable name -icon., and retrieves it through the /download/ endpoint. The same behavior provides a file-existence oracle through the icon_path report field. This issue is fixed in version 4.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-68922
EUVD
EUVD-2026-61132

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mobsf mobsf 4.5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-68922 is a path traversal vulnerability in MobSF, a mobile security testing tool. It occurs in the find_icon_path_zip function which processes the android:icon attribute from Android manifests without proper validation. Attackers can craft malicious ZIP or APK files with path traversal sequences in the android:icon value to read arbitrary files from the server's filesystem. These files are then copied to a downloads directory and made accessible via a predictable URL.

Detection Guidance

Check MobSF version with: pip show mobsf or docker inspect <container>. If version is <=4.5.0, the system is vulnerable. Review scan reports for icon_path fields containing suspicious paths like res/../../../. Monitor /download/ endpoint access logs for unexpected file downloads.

Impact Analysis

This vulnerability allows authenticated attackers with scan permissions to read sensitive files on the server, including configuration files, internal data, or security artifacts. It also acts as a file existence oracle, letting attackers check if specific files exist on the server by examining the icon_path field in scan reports. The impact is limited to confidentiality as integrity and availability are less affected.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive data such as personal or health information stored on the server. Unauthorized file access may violate data protection requirements for confidentiality and integrity, potentially resulting in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade MobSF to version 4.5.1 or later immediately. If upgrading is not possible, restrict file uploads to trusted users only and implement network-level access controls to block unauthorized /download/ endpoint access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68922. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart