MobSF vulnerabilities

CVEs per yearBy the year they were published

1. 20246
2. 20258
3. 20266

Newest CVEs

• CVE-2026-68923

  MobSF: CSRF checks not enforced after Django migration

  MobSF · Mobile-Security-Framework-MobSF

  Medium6.5
• CVE-2026-68927

  MobSF: SSRF port restriction bypass in assetlinks_check

  MobSF · Mobile-Security-Framework-MobSF

  Low3.0
• CVE-2026-68922

  MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads

  MobSF · Mobile-Security-Framework-MobSF

  Medium5.5
• CVE-2026-68924

  MobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

  MobSF · Mobile-Security-Framework-MobSF

  Medium4.9
• CVE-2026-33545

  MobSF has SQL Injection in its SQLite Database Viewer Utils

  MobSF · Mobile-Security-Framework-MobSF

  Medium5.3
• CVE-2026-24490

  MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field

  MobSF · Mobile-Security-Framework-MobSF

  High8.1
• CVE-2025-58162

  MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction

  MobSF · Mobile-Security-Framework-MobSF

  Medium6.5
• CVE-2025-58161

  MobSF Path Traversal in GET /download/<filename> using absolute filenames

  MobSF · Mobile-Security-Framework-MobSF

  Low1.3
• CVE-2025-46730

  Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack

  MobSF · Mobile-Security-Framework-MobSF

  Medium6.8
• CVE-2025-46335

  Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload

  MobSF · Mobile-Security-Framework-MobSF

  High8.6