CVE-2024-43399 Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files
An attacker can exploit a Zip Slip vulnerability in MobSF to extract files to arbitrary locations on the server, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-43399?
CVE-2024-43399 is a high-severity path traversal vulnerability in Mobile-Security-Framework-MobSF, published on 19 Aug 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Before 4.0.7, there is a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure intended to prevent Zip Slip attacks is improperly implemented. Since the implemented measure can be bypassed, the vulnerability allows an attacker to extract files to any desired location within the server running MobSF. This vulnerability is fixed in 4.0.7.
Which versions are affected by CVE-2024-43399?
3 open source packages ship an affected version, including mobsf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mobsf PyPI | All versions | 4.0.7 |
mobsf PyPI | All versions | 4.0.7 |
mobsf PyPI | All versions | 4.0.7 |
Products include Opensecurity Mobile Security Framework.
How do I fix CVE-2024-43399?
Upgrade mobsf to 4.0.7 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-43399 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-43399 exists.
Other vulnerabilities in Mobile-Security-Framework-MobSF
- CVE-2025-46335 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
- CVE-2025-24805 Local Privilege Escalation in MobSF
- CVE-2025-24803 Stored Cross-Site Scripting (XSS) in MobSF
- CVE-2026-24490 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
- CVE-2024-53999 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
Sources
Also known as GHSA-4hh3-vj32-gr6j, PYSEC-2026-1665.