CVE-2026-68924

Name of the Vulnerable Software and Affected Versions MobSF versions prior to 4.5.1

Description The unzip() function in mobsf/StaticAnalyzer/views/common/shared func.py fails to properly handle archive members that exceed the ZIP MAX UNCOMPRESSED FILE SIZE limit. While the system logs that the oversized member is being skipped, it does not proceed to the next member. This allows an authenticated user to upload a specially crafted ZIP or APK file where an oversized member is extracted to disk if the ZIP MAX UNCOMPRESSED TOTAL SIZE aggregate limit has not been reached, which can lead to disk space exhaustion and prevent further scans.

Recommendations Update to version 4.5.1.