CVE-2026-68922

MobSF is a mobile application security testing tool used. Prior to 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment, allowing an authenticated user to upload a crafted ZIP or APK that reads a server file with an ALLOWED_EXTENSIONS suffix, copies it to DWD_DIR as the predictable name -icon., and retrieves it through the /download/ endpoint. The same behavior provides a file-existence oracle through the icon_path report field. This issue is fixed in version 4.5.1.

• CWE-22

• https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8j49-mmcx-4mp5
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8j49-mmcx-4mp5

Published

Aug 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-68904node-opcua is an OPC UA implementation for TypeScript and No…7
• CVE-2026-6891Improper handling of symbolic links in the installer of My I…5.1
• CVE-2026-68914Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-68919GoCD is a continuous deliver server. From 13.3.0 until 26.1.…7
• CVE-2026-6892Improper handling of symbolic links in the installer of CUPS…5.1
• CVE-2026-68921DiceBear is an avatar library for designers and developers. …4.7
• CVE-2026-68923MobSF is a mobile application security testing tool used. Pr…6.5
• CVE-2026-68924MobSF is a mobile application security testing tool used. Pr…4.9
• CVE-2026-68927MobSF is a mobile application security testing tool used. Pr…3
• CVE-2026-68928Acode is a powerful text and code editor for Android. From 1…8.6
• CVE-2026-68929FastGPT is an open-source LLM platform for building AI appli…9.3
• CVE-2026-6893A flaw was found in dracut. A remote attacker on the adjacen…7.5