CVE-2022-41547 MobSF allows attackers to read arbitrary files via a crafted HTTP request

What is CVE-2022-41547?

CVE-2022-41547 is a high-severity path traversal vulnerability in n/a, published on 18 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request.

Weakness: CWE-98

Which versions are affected by CVE-2022-41547?

3 open source packages ship an affected version, including mobsf. It affects 1 product.

Products include Opensecurity Mobile Security Framework.

How do I fix CVE-2022-41547?

Upgrade mobsf to 0.9.3 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-41547 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-41547 exists.

Other vulnerabilities in n/a

• CVE-2025-46335 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload High 8.6
• CVE-2025-24805 Local Privilege Escalation in MobSF High 8.5
• CVE-2025-24803 Stored Cross-Site Scripting (XSS) in MobSF High 8.4
• CVE-2026-24490 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field High 8.1
• CVE-2024-53999 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f42p-vc8p-7x54, PYSEC-2026-848.