Mobsf Mobile-Security-Framework-Mobsf vulnerabilities

CVE-2024-43399 [CRITICAL] CWE-23 CVE-2024-43399: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framewo Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Before 4.0.7, there is a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure intended to prevent Zip Slip attacks is improperly im

CVE-2024-41955 [MEDIUM] CWE-601 CVE-2024-41955: Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. Update to MobSF v4.0.5.

CVE-2024-29190 [HIGH] CWE-918 CVE-2024-29190: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framewo Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In version 3.9.5 Beta and prior, MobSF does not perform any input validation when extracting the hostnames in `android:host`, so requests can also be sent to local hostnames. This can lead to server-

CVE-2025-58162 [MEDIUM] CWE-22 CVE-2025-58162: MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user wh MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary files to any directory writable by the user of the MobSF process. This issue has been patched in version 4.4.1.

CVE-2025-46730 [MEDIUM] CWE-409 CVE-2025-46730: MobSF is a mobile application security testing tool used. Typically, MobSF is deployed on centralize MobSF is a mobile application security testing tool used. Typically, MobSF is deployed on centralized internal or cloud-based servers that also host other security tools and web applications. Access to the MobSF web interface is often granted to internal security teams, audit teams, and external vendors. MobSF provides a feature that allows users to

CVE-2026-33545 [MEDIUM] CWE-89 CVE-2026-33545: MobSF is a mobile application security testing tool used. Prior to version 4.4.6, MobSF's `read_sqli MobSF is a mobile application security testing tool used. Prior to version 4.4.6, MobSF's `read_sqlite()` function in `mobsf/MobSF/utils.py` (lines 542-566) uses Python string formatting (`%`) to construct SQL queries with table names read from a SQLite database's `sqlite_master` table. When a security analyst uses MobSF to analyze a malicious mobile

CVE-2025-58161 [MEDIUM] CWE-22 CVE-2025-58161: MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from "neighboring" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../do

CVE-2024-53999 [MEDIUM] CWE-79 CVE-2024-53999: Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framewo Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the application use the "Diff

CVE-2025-24803 [MEDIUM] CWE-79 CVE-2025-24803: Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Window Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters (A–Z, a–z, and 0–9), hyphens (-), and periods (.). However, an attacker can manually mo

CVE-2025-46335 [MEDIUM] CWE-79 CVE-2025-46335: Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting (XSS) vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG files during the Android APK analysis

CVE-2025-24805 [MEDIUM] CWE-269 CVE-2025-24805: Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Window Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 an

CVE-2024-31215 [MEDIUM] CWE-918 CVE-2024-31215: Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When a malicious app is uploaded to Static anal

CVE-2026-24490 [MEDIUM] CWE-79 CVE-2026-24490: MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-sit MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The `android:host` attribute from `` elements is rendered

CVE-2025-24804 [MEDIUM] CWE-1287 CVE-2025-24804: Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Window Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters (A–Z, a–z, and 0–9), hyphens (-), and periods (.). However, an attacker can manually