CVE-2025-31116 Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding
Attackers can bypass SSRF protections in MobSF using DNS rebinding to access internal resources or bypass host validation checks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-31116?
CVE-2025-31116 is a medium-severity server-side request forgery vulnerability in Mobile-Security-Framework-MobSF, published on 31 Mar 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.
Weakness: CWE-918
Which versions are affected by CVE-2025-31116?
3 open source packages ship an affected version, including mobsf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mobsf PyPI | All versions | 4.3.2 |
mobsf PyPI | All versions | 4.3.2 |
mobsf PyPI | All versions | 4.3.2 |
Products include Opensecurity Mobile Security Framework.
How do I fix CVE-2025-31116?
Upgrade mobsf to 4.3.2 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-31116 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-31116 exists.
Other vulnerabilities in Mobile-Security-Framework-MobSF
- CVE-2025-46335 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
- CVE-2025-24805 Local Privilege Escalation in MobSF
- CVE-2025-24803 Stored Cross-Site Scripting (XSS) in MobSF
- CVE-2026-24490 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
- CVE-2024-53999 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
Sources
Also known as GHSA-fcfq-m8p6-gw56, PYSEC-2025-48.