CVE-2024-43399: high-severity vulnerability in MobSF Mobile-Security-Framework-MobSF
Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8epss 1.0%
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Before 4.0.7, there is a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure intended to prevent Zip Slip attacks is improperly implemented. Since the implemented measure can be bypassed, the vulnerability allows an attacker to extract files to any desired location within the server running MobSF. This vulnerability is fixed in 4.0.7.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected products
MobSF · Mobile-Security-Framework-MobSFRelated CVEs — MobSF Mobile-Security-Framework-MobSF
In the same product, most dangerous first.
CVE-2024-41955MEDIUMMobile Security Framework (MobSF) has an Open Redirect in Login RedirectEPSS 1.0%CVE-2025-58161LOWMobSF Path Traversal in GET /download/<filename> using absolute filenamesEPSS 0.8%CVE-2024-29190HIGHMobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)EPSS 0.7%CVE-2025-58162MEDIUMMobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a ExtractionEPSS 0.6%CVE-2026-68924MEDIUMMobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK ExtractionEPSS 0.6%CVE-2025-46730MEDIUMMobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death AttackEPSS 0.5%