CVE-2025-46730: MobSF ZIP of Death Vulnerability Leading to Server Resource Exhaustion
Summary
CVE-2025-46730: Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack. Affects mobsf versions < 4.3.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mobile Security Framework (MobSF) is a widely used mobile application security testing tool that assists security teams in analyzing mobile applications for vulnerabilities. It is often deployed on centralized servers, either internally or in the cloud, and provides a web interface for users to upload files for static analysis. MobSF's functionality includes the ability to upload ZIP files, which are then extracted for analysis. However, this feature lacks proper safeguards against oversized files, making it susceptible to specific types of attacks.
Vulnerability Detail
The vulnerability arises from MobSF's failure to check the total uncompressed size of uploaded ZIP files. This oversight allows attackers to exploit the system by uploading a 'ZIP of Death' or zip bomb, a small compressed file that expands to a massive size upon extraction. For instance, an attacker can create a ZIP file that, when extracted, consumes significant disk space, potentially exhausting the server's resources and leading to a denial of service (DoS). This can disrupt not only MobSF but also other applications hosted on the same server, causing widespread operational issues.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually inspect ZIP files before uploading them to ensure they do not contain excessively large files that could lead to resource exhaustion. Additionally, restricting access to the MobSF web interface to trusted users can help mitigate the risk of exploitation.
Conclusion
The MobSF ZIP of Death vulnerability (CVE-2025-46730) poses a significant risk to organizations using this tool for mobile application security testing. By failing to check the uncompressed size of uploaded ZIP files, MobSF allows attackers to exploit this weakness, leading to potential server resource exhaustion. It is crucial for users to update to a patched version and implement necessary safeguards to mitigate this risk.
See every vulnerability recorded for mobsf →
FAQ
A ZIP of Death attack involves uploading a specially crafted ZIP file that is small in size but expands to a massive size upon extraction, leading to resource exhaustion.
If you are using MobSF version 4.3.2 or earlier, your installation is vulnerable to this issue. You can check your version by running 'pip show mobsf'.
Exploiting this vulnerability can lead to complete server disruption, affecting not only MobSF but also other applications and services hosted on the same server.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground.
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mobsf.
