CVE-2026-68922: MobSF Path Traversal Vulnerability

CVE-2026-68922 Overview

CVE-2026-68922 is a path traversal vulnerability [CWE-22] in Mobile Security Framework (MobSF), an open-source mobile application security testing tool. The flaw resides in the find_icon_path_zip function within mobsf/StaticAnalyzer/views/android/icon_analysis.py. The function uses the android:icon value from the Android manifest to construct paths under the scan resource directory without rejecting directory traversal sequences or verifying containment. An authenticated user can upload a crafted ZIP or APK to read arbitrary server files matching allowed extensions. The issue is fixed in MobSF version 4.5.1.

Critical Impact
Authenticated attackers can read server files with ALLOWED_EXTENSIONS suffixes via the /download/ endpoint and use the icon_path report field as a file-existence oracle.

Affected Products

Mobile Security Framework (MobSF) versions prior to 4.5.1
mobsf/StaticAnalyzer/views/android/icon_analysis.py component
Static analyzer icon extraction workflow

Discovery Timeline

2026-08-18 - CVE-2026-68922 published to NVD
2026-08-19 - Last updated in NVD database
Fix released - MobSF version 4.5.1 published on GitHub with the patch

Technical Details for CVE-2026-68922

Vulnerability Analysis

The vulnerability affects the static analyzer path that processes Android application archives. When MobSF parses an uploaded APK or ZIP, it reads the android:icon attribute from the Android manifest and uses that value to build a filesystem path inside the scan resource directory. The find_icon_path_zip function does not sanitize traversal sequences such as ../ and does not confirm that the resolved path stays within the intended directory.

An authenticated user can craft an APK whose manifest declares an android:icon value pointing at an arbitrary server location. MobSF then resolves this path, copies the target file into DWD_DIR under a predictable name ending in -icon.<ext>, and exposes it through the /download/ endpoint. The same code path leaks information via the icon_path field in the analysis report, providing a file-existence oracle even when the file cannot be retrieved.

Root Cause

The root cause is missing input validation on attacker-controlled manifest data used in path construction. MobSF trusts the android:icon string and joins it to a base directory without normalizing the result or asserting containment. Any file on disk whose extension matches ALLOWED_EXTENSIONS becomes reachable through the icon resolution logic.

Attack Vector

Exploitation requires an authenticated MobSF account. The attacker uploads a malicious APK or ZIP that embeds a traversal payload in the manifest's android:icon attribute. After scanning, the attacker downloads the copied file from /download/ or reads the icon_path field to confirm target existence. Since the attack traverses the network and requires only a valid session, exposed MobSF instances are the primary risk surface.

python

# Patched imports centralize traversal and injection checks in mobsf.MobSF.security
# mobsf/DynamicAnalyzer/views/common/device.py
from mobsf.MobSF.views.authentication import (
    login_required,
)
from mobsf.MobSF.security import is_safe_path
from mobsf.MobSF.utils import (
    is_md5,
    print_n_send_error_response,
    read_sqlite,
)
# Source: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf

The patch consolidates path-safety helpers such as is_safe_path and is_attack_pattern into a dedicated mobsf.MobSF.security module, ensuring uploaded artifact paths are validated before use. Full technical context is available in the GitHub Security Advisory GHSA-8j49-mmcx-4mp5 and the MobSF Pull Request Discussion.

Detection Methods for CVE-2026-68922

Indicators of Compromise

Files under DWD_DIR named with the pattern <hash>-icon.<ext> that contain content unrelated to a legitimate application icon.
Analysis reports where the icon_path field references paths outside the expected scan resource directory or contains ../ sequences.
HTTP GET requests to the /download/ endpoint referencing icon files immediately after an APK or ZIP upload from a non-administrator account.

Detection Strategies

Inspect stored AndroidManifest.xml artifacts from prior scans for android:icon values containing ../ or absolute path prefixes.
Correlate MobSF authentication events with upload activity and subsequent /download/ requests to identify anomalous access patterns.
Alert on MobSF instances running versions earlier than 4.5.1 discovered through software inventory.

Monitoring Recommendations

Enable verbose web-server logging for the MobSF application and retain upload and download telemetry for at least 90 days.
Track process file-access events on the MobSF host to detect reads of files outside the expected scan directories.
Monitor the DWD_DIR directory for icon files whose MIME type or content diverges from expected image formats.

How to Mitigate CVE-2026-68922

Immediate Actions Required

Upgrade all MobSF deployments to version 4.5.1 or later, available in the MobSF v4.5.1 Release.
Rotate MobSF user credentials and API keys if the instance was accessible to untrusted users prior to patching.
Audit the DWD_DIR directory and remove any icon files sourced from suspicious scans.

Patch Information

The fix is delivered in MobSF 4.5.1 via commit 62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf. The patch introduces a centralized mobsf.MobSF.security module that exposes is_safe_path, is_attack_pattern, and cmd_injection_check helpers. The find_icon_path_zip code path now validates that the resolved icon location remains within the expected scan resource directory before any copy or download operation.

Workarounds

Restrict MobSF access to trusted analysts only and place the service behind an authenticated reverse proxy or VPN.
Disable or gate self-service account registration to prevent untrusted users from obtaining upload rights.
Run MobSF under a low-privilege system account so any traversed reads cannot reach sensitive host files.

bash

# Upgrade MobSF to the fixed version
git fetch --tags
git checkout v4.5.1
pip install -r requirements.txt
./run.sh 127.0.0.1:8000