CVE-2026-68927
Received Received - Intake

Path Traversal in MobSF Prior to 4.5.1

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MobSF is a mobile application security testing tool used. Prior to 4.5.1, get_browsable_activities in mobsf/StaticAnalyzer/views/android/manifest_analysis.py validates only an Android manifest android:host value with valid_host before appending a separately supplied android:port to the URL fetched by _check_url, allowing an authenticated user to upload a crafted APK that makes requests to an attacker-selected nonstandard port at /.well-known/assetlinks.json. With an attacker-controlled hostname and DNS rebinding between validation and the requests.get connection, the request can reach an internal service, although redirects remain disabled and the path is fixed. This issue is fixed in version 4.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-68927
EUVD
EUVD-2026-61133

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mobsf mobsf 4.5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-68927 is a Server-Side Request Forgery (SSRF) vulnerability in MobSF versions 4.5.0 and earlier. It occurs when MobSF validates only the host in an Android manifest's App Link data tag but appends a port value without proper validation. This allows an attacker to craft an APK that causes MobSF to fetch a URL with a non-standard port, potentially reaching internal services if combined with DNS rebinding.

Detection Guidance

To detect this SSRF vulnerability in MobSF, monitor outbound requests from MobSF to non-standard ports (e.g., ports other than 80 or 443) during APK analysis. Check logs for requests to /.well-known/assetlinks.json with custom ports. Ensure MobSF is updated to version 4.5.1 or later to confirm the fix is applied.

Impact Analysis

An authenticated user could upload a malicious APK to trigger outbound requests to internal services on non-standard ports. The attacker can control the hostname and port, potentially accessing restricted internal resources. However, the impact is limited to the fixed path /.well-known/assetlinks.json and redirects are disabled.

Mitigation Strategies

Immediately upgrade MobSF to version 4.5.1 or later to address the SSRF vulnerability. If upgrading is not possible, restrict network access for MobSF to prevent outbound connections to internal services. Monitor network traffic for suspicious requests to non-standard ports during APK analysis.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68927. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart