CVE-2026-68922: Arbitrary File Read via Path Traversal in MobSF ZIP/APK Icon Extraction

The Mobile Security Framework (MobSF) serves as an automated environment for conducting static and dynamic analysis on mobile applications, including Android packages (APK) and compressed archives (ZIP).

During the static analysis stage of an uploaded file, MobSF performs an analysis of application metadata, including identifying and extracting the application icon from the binary resources. The logic responsible for this operation is implemented in mobsf/StaticAnalyzer/views/android/icon_analysis.py under the function find_icon_path_zip.

The vulnerability, registered as CVE-2026-68922, belongs to the Improper Limitation of a Pathname to a Restricted Directory category (CWE-22). An authenticated remote attacker can exploit this flaw to bypass the extraction directory boundaries, mapping relative directory traversal references to files located on the host filesystem.

This behavior exposes the underlying application environment to arbitrary file readout. Because files are copied into a publicly predictable and reachable download directory, security properties relating to configuration isolation and local file security are compromised.

The fundamental cause of CVE-2026-68922 is the implicit trust placed in the metadata extracted from an untrusted document's manifest. When analyzing an archive, MobSF extracts the path designated by the android:icon attribute inside AndroidManifest.xml.

To construct the local file path for extraction, the application performs prefix stripping and path joining operations. The code attempts to clean the relative icon path using the following Python instruction:

stripped_relative_path = icon_path.strip('/res')

This approach introduces a systematic logical bug. In Python, the str.strip() method removes all combinations of characters defined in the arguments rather than the exact literal substring. Consequently, a string such as /res/security.png undergoes partial stripping of its actual filename (resulting in ecurity.png). More critically, this operation fails to sanitize or impede standard relative traversal sequences containing ../ segments.

Once the stripped path is obtained, the application joins it with the resource directory (res_dir) using os.path.join(). In Python, os.path.join merges path elements sequentially. If the latter part of the argument contains path traversal tokens (e.g., ../../../../etc/passwd), the output resolves to a location outside the parent directory. Without an explicit check verifying that the resolved canonical path remains within the bounds of res_dir, the application will validate the file existence and prepare it for retrieval.

A review of the vulnerable implementation compared to the official fix highlights the logical gap and the remediation approach.

Vulnerable Implementation

def find_icon_path_zip(checksum, res_dir, icon_paths_from_manifest):
    # ... logs and checks ...
    for icon_path in icon_paths_from_manifest:
        if icon_path.startswith('@'):
            # ... resource handling ...
        elif icon_path.startswith(('res/', '/res/')):
            # BUG: strip() removes characters '/','r','e','s' individually, not as a string prefix
            stripped_relative_path = icon_path.strip('/res')
            # BUG: os.path.join resolves directory traversal sequences without containment checks
            full_path = os.path.join(res_dir, stripped_relative_path)
            if os.path.exists(full_path):
                return full_path

Patched Implementation

The patch introduces two critical sanitization utilities from mobsf.MobSF.security: is_path_traversal and is_safe_path. These functions ensure that arbitrary directory manipulation sequences are caught and blocked.

# From mobsf/StaticAnalyzer/views/android/icon_analysis.py
for icon_path in icon_paths_from_manifest:
    # Step 1: Detect explicit path traversal strings early
    if is_path_traversal(icon_path):
        logger.warning('Path traversal detected in icon path: %s', icon_path)
        continue
    
    # ... 
    elif icon_path.startswith(('res/', '/res/')):
        # Step 2: Safely compute the relative path without using str.strip()
        rel = icon_path.lstrip('/')
        if rel.startswith('res/'):
            rel = rel[len('res/'):]
        
        full_path = os.path.join(res_dir, rel)
        # Step 3: Validate that the resolved target path remains inside res_dir boundary
        if not is_safe_path(res_dir, full_path, icon_path):
            continue
        if os.path.exists(full_path):
            return full_path

By leveraging os.path.realpath to resolve symbolic links and canonical paths, is_safe_path ensures that all operations remain bounded to the extraction directory. The modification resolves both the fragile parsing and the directory breakout.

An attack targeting CVE-2026-68922 relies on an authenticated user's ability to upload a customized application package. The attacker structures a ZIP or APK payload containing a manipulated AndroidManifest.xml file.

Exploitation Walkthrough

1. Payload Construction: The attacker compiles an archive where the android:icon attribute within the manifest points to a targeted file using relative directory traversal identifiers, e.g., res/../../../../../../etc/passwd.

2. Analysis Submission: The attacker submits the archive to the static analysis upload API. The server receives the file, computes its MD5 checksum, and kicks off resource unpacking.

3. Extraction & Relocation: When the backend invokes find_icon_path_zip, the traversal sequences resolve directly to the host filesystem file. Since the file exists on the filesystem and contains a matching suffix or can be resolved, the application proceeds to copy the file to the predictable public directory (DWD_DIR) named with the template format [md5_checksum]-icon.[extension].

4. Exfiltration: The attacker fetches the exfiltrated document by making a GET request directly to /download/[md5_checksum]-icon.passwd.

The exploitation of CVE-2026-68922 enables arbitrary file reading capabilities with the system permissions of the user context running the MobSF process. If the application is deployed as root inside a container or directly on a host machine, an attacker could potentially capture configuration files, database credentials, environment variables, or private SSH keys.

> [!NOTE] > The severity is evaluated as Medium (CVSS 5.5) due to the prerequisite of user authentication. However, in environments with self-registration enabled or where API keys are widely distributed to CI/CD pipelines, this authentication requirement presents minimal barrier to entry.

File Existence Oracle

In addition to direct file download, the analysis report exposes an auxiliary side-channel. If the target file is read-protected or cannot be copied to the public downloads folder, the icon_path field in the resulting analysis metadata report still logs whether the system located the file. This creates an efficient file-existence oracle, allowing adversaries to map internal system directory hierarchies and verify the presence of security tooling, specific library packages, or administrative files.

The primary remediation mechanism is upgrading the MobSF deployment to version 4.5.1 or later. The update introduces the path containment logic and correctly resolves the string parsing issue.

Immediate Workarounds and Mitigations

If an immediate software upgrade is not feasible, the following operational mitigations should be applied:

• Host User Isolation: Run the MobSF service under a dedicated, low-privilege service account rather than as the root user. This limits file-read exposure exclusively to files readable by that account.

• Network Access Restraints: Restrict the MobSF HTTP port to local network ranges or dedicated corporate VPN gateways. Disable public sign-up or registration pages on the instance.

• Read-only Filesystems: If possible, mount critical host directories as read-only or omit them from the container mapping context altogether to prevent traverse access.