MobSF, before release 4.5.1, failed to fully validate Android manifest host values before concatenating a separately supplied port into the URL used by _check_url. This permits an authenticated user to upload a crafted APK such that the resulting HTTP request targets an attacker‑controlled hostname on any non‑standard port, using the path /.well-known/assetlinks.json. The port restriction that normally limits SSRF to standard ports is circumvented, while redirects remain disabled and the path is fixed. The vulnerability is classified as CWE‑918 and could be leveraged to reach internal services via arbitrary ports, potentially exposing internal resources or initiating unwanted actions.

MobSF Mobile‑Security‑Framework‑MobSF, versions prior to 4.5.1. Upgrading to 4.5.1 or later removes the flaw.

The CVSS score of 3.0 indicates low baseline severity, and the EPSS score is not available, suggesting limited exploitation data. The flaw requires a valid authenticated user with APK upload privileges, attacker‑controlled DNS rebinding, and knowledge of internal service ports to succeed. Given these prerequisites, the likelihood of exploitation in the wild is moderate but not negligible, especially in environments where the MobSF instance is exposed and authenticated users are granted upload rights. Because the vulnerability is not present in the CISA KEV catalog, widespread exploitation is currently unlikely, yet the impact if exploited could provide internal network reconnaissance or further attack surface expansion.