CVE-2025-46730

MobSF is a mobile application security testing tool used. Typically, MobSF is deployed on centralized internal or cloud-based servers that also host other security tools and web applications. Access to the MobSF web interface is often granted to internal security teams, audit teams, and external vendors. MobSF provides a feature that allows users to upload ZIP files for static analysis. Upon upload, these ZIP files are automatically extracted and stored within the MobSF directory. However, in versions up to and including 4.3.2, this functionality lacks a check on the total uncompressed size of the ZIP file, making it vulnerable to a ZIP of Death (zip bomb) attack. Due to the absence of safeguards against oversized extractions, an attacker can craft a specially prepared ZIP file that is small in compressed form but expands to a massive size upon extraction. Exploiting this, an attacker can exhaust the server's disk space, leading to a complete denial of service (DoS) not just for MobSF, but also for any other applications or websites hosted on the same server. This vulnerability can lead to complete server disruption in an organization which can affect other internal portals and tools too (which are hosted on the same server). If some organization has created their customized cloud based mobile security tool using MobSF core then an attacker can exploit this vulnerability to crash their servers. Commit 6987a946485a795f4fd38cebdb4860b368a1995d fixes this issue. As an additional mitigation, it is recommended to implement a safeguard that checks the total uncompressed size of any uploaded ZIP file before extraction. If the estimated uncompressed size exceeds a safe threshold (e.g., 100 MB), MobSF should reject the file and notify the user.

• CWE-409

• https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/6987a946485a795f4fd38cebdb4860b368a1995dPatch
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-c5vg-26p8-q8crExploit, Third Party Advisory

Published

May 5, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46725Langroid is a Python framework to build large language model…9.8
• CVE-2025-46726Langroid is a framework for building large-language-model-po…9.1
• CVE-2025-46727Rack is a modular Ruby web server interface. Prior to versio…7.5
• CVE-2025-46728cpp-httplib is a C++ header-only HTTP/HTTPS server and clien…7.5
• CVE-2025-46729julmud/phpDVDProfiler is an adoption of the defunct phpDVDPr…2.1
• CVE-2025-4673Proxy-Authorization and Proxy-Authenticate headers persisted…6.8
• CVE-2025-46731Craft is a content management system. Versions of Craft CMS …7.2
• CVE-2025-46732OpenCTI is an open source platform for managing cyber threat…5.4
• CVE-2025-46733OP-TEE is a Trusted Execution Environment (TEE) designed as …7.9
• CVE-2025-46734league/commonmark is a PHP Markdown parser. A cross-site scr…6.4
• CVE-2025-46735Terraform WinDNS Provider allows users to manage their Windo…1.1
• CVE-2025-46736Umbraco is a free and open source .NET content management sy…5.3