CVE-2026-68922

### Summary The `find_icon_path_zip()` function in MobSF does not properly sanitize the `android:icon` attribute extracted from an Android manifest before resolving it as a filesystem path. An attacker can supply a malicious `android:icon` value containing path traversal sequences, causing MobSF to read arbitrary files from the server filesystem and copy them into the downloads directory (`DWD_DIR`). These files can then be retrieved by any authenticated user via the `/download/<filename>` endpoint, provided the file extension is included in `ALLOWED_EXTENSIONS`. ### Details ``` elif icon_path.startswith(('res/', '/res/')): stripped_relative_path = icon_path.strip('/res') # Works for neither /res nor res full_path = os.path.join(res_dir, stripped_relative_path) if os.path.exists(full_path): return full_path full_path += '.png' if os.path.exists(full_path): return full_path ``` https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/6e875fb77baa9dbe65ff8e7d0344d740e1d6d51e/mobsf/StaticAnalyzer/views/android/icon_analysis.py#L126 This code enables path traversal if a value like 'res/../../../signatures/maltrail-malware-domains.txt' is used as the icon path. This path will resolve to outside the scan directory, and the file will eventually be copied into `DWD_DIR/<md5>-icon.<ext>`: ``` icon_file = find_icon_path_zip( app_dic['md5'], res_path, icon_from_mfst) if icon_file and Path(icon_file).exists(): dwd = Path(settings.DWD_DIR) out = dwd / (app_dic['md5'] + '-icon' + Path(icon_file).suffix) copy2(icon_file, out) app_dic['icon_path'] = out.name ``` https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/6e875fb77baa9dbe65ff8e7d0344d740e1d6d51e/mobsf/StaticAnalyzer/views/android/icon_analysis.py#L101 Because the output filename is derived from the MD5 hash of the uploaded archive (which the attacker can compute locally for his own ZIP), the attacker can deter