CVE-2026-68922

In MobSF versions before 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py constructs paths from the manifest android:icon value without sanitizing traversal or verifying containment. An authenticated user can upload a crafted ZIP/APK to read server files matching A...