What’s Vulnerable › Products
MobSF Mobile-Security-Framework-MobSF vulnerabilities
22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.
Check whether your MobSF Mobile-Security-Framework-MobSF version is affected
Latest MobSF Mobile-Security-Framework-MobSF vulnerabilities
- CVE-2026-68927 — MobSF: SSRF port restriction bypass in assetlinks_check (CVSS 3.0)
- CVE-2026-68924 — MobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction (CVSS 4.9)
- CVE-2026-68923 — MobSF: CSRF checks not enforced after Django migration (CVSS 6.5)
- CVE-2026-68922 — MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads (CVSS 5.5)
- CVE-2026-33545 — MobSF has SQL Injection in its SQLite Database Viewer Utils (CVSS 6.5)
- CVE-2026-24490 — MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field (CVSS 4.8)
- CVE-2025-58162 — MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction (CVSS 6.5)
- CVE-2025-58161 — MobSF Path Traversal in GET /download/<filename> using absolute filenames (CVSS 4.3)
- CVE-2025-46730 — Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack (CVSS 6.5)
- CVE-2025-46335 — Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload (CVSS 5.4)
- CVE-2025-31116 — Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding (CVSS 9.8)
- CVE-2025-24805 — Local Privilege Escalation in MobSF (CVSS 5.5)
- CVE-2025-24804 — Partial Denial of Service (DoS) in MobSF (CVSS 4.3)
- CVE-2025-24803 — Stored Cross-Site Scripting (XSS) in MobSF (CVSS 5.4)
- CVE-2024-54000 — Mobile Security Framework (MobSF) bypass of SSRF fix (CVSS 7.5)
- CVE-2024-53999 — Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality (CVSS 5.4)
- CVE-2024-43399 — Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files (CVSS 9.8)
- CVE-2024-41955 — Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect (CVSS 5.4)
- CVE-2024-31215 — Mobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database check (CVSS 4.3)
- CVE-2024-29190 — MobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns) (CVSS 7.5)
- CVE-2023-42261 — (CVSS 7.5)
- CVE-2022-41547 — (CVSS 7.5)