GitHub Advisoryadvisory · PyPI

GHSA-mwfg-948f-2cc5 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload

MEDIUM Published 2025-05-05 Modified 2025-05-05 Official page ↗
Aliases
CVE-2025-46335
Ecosystem
PyPI
Packages
mobsf
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2025-05-05

Affected packages

• PyPI mobsf: < 4.3.3 → fixed in 4.3.3

Description

Vulnerable MobSF Versions: .svg This file becomes publicly accessible via the web interface at: http://127.0.0.1:8081/download/filename.svg If the SVG contains embedded JavaScript (e.g., an XSS payload), accessing this URL via a browser leads to the execution of the script in the context of the MobSF user session, resulting in stored XSS. Proof Of Concept: 1. Create a malicious SVG file (ic_launcher.svg) with an embedded XSS payload. 2. Place the file in the Android Studio project directory: /app/src/main/res/mipmap-hdpi/ic_launcher.svg 3. Zip the project directory and upload it to MobSF. 4. After the scan, navigate to the "Recent Scans" page in the MobSF web interface and click on the scan entry and open the icon file in a new browser tab. 5. The XSS payload is executed, confirming the vulnerability.

Related

Alias · CVE (1)

  • CVE-2025-46335 Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References