CVE-2024-53999: Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-12-03 · updated 2026-06-17
Weakness: CWE-79

Description

Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the application use the "Diff or Compare" functionality, they are affected by a Stored Cross-Site Scripting vulnerability. This vulnerability is fixed in 4.2.9.

Affected products

MobSF Mobile-Security-Framework-MobSF: before 4.2.9 — fixed in 4.2.9

How to fix

Upgrade to a fixed version: MobSF Mobile-Security-Framework-MobSF 4.2.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-53999 or the next vulnerability affects your stack