CVE-2022-41547High· 7.5▾ TwilightMobSF allows attackers to read arbitrary files via a crafted HTTP request
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.2%
1.2% → 1.3%
Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request.
mobsf < 0.9.3Upgrade to a patched release:
mobsf 0.9.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-33545Medium· 5.3MobSF has SQL Injection in its SQLite Database Viewer Utils
CVE-2024-31215Medium· 6.3Mobile Security Framework (MobSF) vulnerable to SSRF in firebase database check
CVE-2025-46335MediumMobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
CVE-2025-24804Medium· 6.5MobSF Partial Denial of Service (DoS)
CVE-2025-24803High· 8.1MobSF Stored Cross-Site Scripting (XSS)
CVE-2025-58161LowMobSF Path Traversal in GET /download/<filename> using absolute filenames