CVE-2025-24805 Local Privilege Escalation in MobSF

What is CVE-2025-24805?

CVE-2025-24805 is a high-severity vulnerability in Mobile-Security-Framework-MobSF, published on 5 Feb 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-269

Which versions are affected by CVE-2025-24805?

3 open source packages ship an affected version, including mobsf. It affects 1 product.

Products include Opensecurity Mobile Security Framework.

How do I fix CVE-2025-24805?

Upgrade mobsf to 4.3.1 or later.

Is CVE-2025-24805 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-24805 exists.

Other vulnerabilities in Mobile-Security-Framework-MobSF

• CVE-2025-46335 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload High 8.6
• CVE-2025-24803 Stored Cross-Site Scripting (XSS) in MobSF High 8.4
• CVE-2026-24490 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field High 8.1
• CVE-2024-53999 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality High 8.1
• CVE-2024-43399 Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files High 8.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-79f6-p65j-3m2m, PYSEC-2026-1667.