MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary files to any directory writable by the user of the MobSF process. This issue has been patched in version 4.4.1.
Fix
Patch, vendor advisory and mitigation references on NVD 1
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.5 · opensecurityNVD modified 2026-10-19 17:10
Affected (CPE criteria) 1
cpe:2.3:a:opensecurity:mobile_security_framework:4.4.0:*:*:*:*:*:*:*
References 3
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/7f3bc086c028c1b50889cab8a15f7b59b7abdaf9 Patch
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.1 Release Notes
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-9gh8-9r95-3fc3 Exploit, Third Party Advisory