The vulnerability resides in the MobSF Android icon analysis module, which builds file paths from a manifest icon value without rejecting traversal or validating containment. An authenticated user can craft a ZIP or APK that causes the application to read a server file ending with an allowed extension, copy it to a predictable temporary file, and then expose it via a download endpoint or as part of a report field. This enables arbitrary file retrieval, providing an information disclosure path and a file‑existence oracle without requiring elevated privileges.

MobSF Mobile‑Security‑Framework‑MobSF prior to version 4.5.1 is affected. Any instance of this tool that accepts ZIP or APK uploads for icon analysis and runs the find_icon_path_zip logic is vulnerable until it is upgraded to 4.5.1 or later.

The CVSS score of 5.5 indicates a moderate impact. Although the EPSS score is not available, the vulnerability requires authenticated access and no additional conditions, which suggests that an attacker can produce a successful exploit simply by uploading a crafted archive. The vulnerability is not listed in the CISA KEV catalog, but the lack of an exploitation probability metric means defenders should treat it as a realistic threat for any environment that uses MobSF for Android analysis.