Executive brief
MobSF is a mobile application security testing framework that scans Android and iOS apps for vulnerabilities. When processing uploaded APK or ZIP files, it attempts to enforce a 400 MB limit per file to prevent disk exhaustion attacks. However, a missing control-flow statement causes the code to log a warning but extract the oversized file anyway, allowing attackers to exhaust disk space and block other users from conducting security scans. This can disrupt the availability of the scanning service and prevent legitimate security reviews.
Technical details
The vulnerability exists in MobSF's ZIP/APK extraction logic in `shared_func.py` (lines 153–182). When a file within an archive exceeds the `ZIP_MAX_UNCOMPRESSED_FILE_SIZE` limit (400 MB), the code logs a warning message saying "Skipping" but fails to include a `continue` statement. This causes execution to fall through to the unconditional `zipptr.extract()` call at line 182, which extracts the oversized file to disk regardless of the size check. An attacker can craft a maliciously large APK containing highly compressible data (e.g., zeros) that will decompress to hundreds of MB when extracted, exhausting available disk space and rendering the scanning service unavailable to other users. This is a control-flow bypass affecting the per-file size enforcement mechanism; the separate total archive size check does not provide adequate protection. The vulnerability is fixed in version 4.5.1 by adding a `continue` statement to skip extraction of oversized files.
Affected products
- MobSF Mobile Security Framework MobSF < 4.5.1
Timeline
- 2026-07-05: disclosed: Published to GitHub Advisory Database
- 2026-08-18: patched: Version 4.5.1 released with fix
- 2026-08-18: advisory: GitHub reviewed and published GHSA-x768-8642-mmq9