CVE-2026-68922: Arbitrary File Read via Path Traversal in MobSF ZIP/APK Icon Extraction

Vulnerability ID: CVE-2026-68922
CVSS Score: 5.5
Published: 2026-08-18

CVE-2026-68922 is a path traversal vulnerability in Mobile Security Framework (MobSF) prior to version 4.5.1. The vulnerability exists within the Android icon extraction process when analyzing uploaded ZIP or APK archives, allowing an authenticated attacker to read arbitrary files from the server.

TL;DR

An authenticated directory traversal flaw in MobSF allows attackers to extract arbitrary files via a crafted AndroidManifest.xml within a ZIP or APK archive.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-22
Attack Vector: Network (AV:N)
CVSS Score: 5.5 (Medium)
Impact: Arbitrary File Read
Exploit Status: Proof of Concept (PoC)
KEV Status: Not Listed

Affected Systems

Mobile Security Framework (MobSF)

Mitigation Strategies

Upgrade to MobSF 4.5.1 or later
Restrict network access to the MobSF interface to trusted personnel
Deploy MobSF containerized with a non-root user execution context

Remediation Steps:

Pull the latest codebase updates using 'git pull origin master' or pull the official Docker image for v4.5.1.
Verify that poetry environment dependencies are up to date using 'poetry install'.
Configure network security groups or firewall rules to restrict access to authorized corporate VPN networks.