Description

MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.py logs that an archive member exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE is being skipped but does not continue to the next member, so an authenticated user can upload a crafted ZIP or APK whose oversized member is extracted to disk when the aggregate ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE limit has not yet been reached, potentially exhausting disk space and preventing further scans. This issue is fixed in version 4.5.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-18T18:19:28.197Z",
  "pubdate": "2026-08-18T18:19:28.197Z",
  "executiveSummary": "A denial of service vulnerability exists in the Mobile Security Framework (MobSF) prior to version 4.5.1, specifically within the archive extraction logic.\nThe vulnerability type is improper input validation leading to disk space exhaustion via logical resource consumption.\nThe impact allows an authenticated user to exhaust available disk space on the hosting server, rendering the application unable to perform further scans and causing a persistent denial of service.\nThe affected product is MobSF, impacting all versions prior to 4.5.1.\nThe risk implications include disruption of service availability and potential degradation of the underlying operating system due to unconstrained file writes.\nAttacker capabilities require authenticated access to the application in order to upload malicious artifacts.\nExploitation requirements include the ability to upload a crafted archive file, such as a ZIP or APK, designed to bypass individual file size checks while violating total aggregate extraction limits.",
  "technicalDetails": "The vulnerability resides in the unzip function located at mobsf/StaticAnalyzer/views/common/shared_func.py within MobSF prior to version 4.5.1.\nThe root cause stems from flawed control flow within the archive extraction loop when evaluating size constraints.\nWhile the extraction routine checks whether an individual archive member exceeds ZIP_MAX_UNCOMPRESSED_FILE_SIZE and logs that the member is being skipped, it fails to explicitly continue to the next iteration of the loop or halt execution appropriately for that specific condition.\nConsequently, under certain conditions where the aggregate ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE limit has not yet been reached, the oversized archive member is improperly processed and extracted to disk.\nAn authenticated attacker exploits this vulnerability by crafting a malicious ZIP or APK archive containing strategically sized files designed to trigger the flawed logic.\nThe attack flow proceeds as follows: First, the authenticated attacker uploads the crafted archive to MobSF for static analysis. Second, the parsing engine iterates through the archive members in shared_func.py. Third, when encountering an oversized member, the application logs the skip message but proceeds to write data to disk because the aggregate size check permits it or execution falls through.\nRepeated or large-scale uploads of such crafted archives consume all available storage resources on the host system.\nThe affected component involves file extraction routines handling user-supplied archives.\nThe vulnerability requires authentication to upload files, but does not necessitate high privileges beyond standard user access capable of initiating scans.\nPost-exploitation impact is limited to denial of service through storage exhaustion rather than remote code execution or privilege escalation."
}