CVE-2025-31116 json
Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding
published 2025-03-31 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-8857 , GHSA-fcfq-m8p6-gw56 , PYSEC-2025-48
- cvss
- 4.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.
Patch / fix
- pypi mobsf 4.3.2
- opensecurity mobile_security_framework 4.3.2
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-fcfq-m8p6-gw56 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L |
| GitHub | 3.1 | 4.4 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mobsf | <4.3.2 |
4.3.2 |
Affected products
- MobSF Mobile-Security-Framework-MobSF
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/MobSF/Mobile-Security-Framework-MobSF/commit/4b8bab5a9858c69fe13be4631b82d82186e0d3bd
web, patch
-
github.com
/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-fcfq-m8p6-gw56
exploit, web, vendor-advisory, advisory, evidence
-
nvd.nist.gov
/vuln/detail/CVE-2025-31116
advisory
-
github.com
/MobSF/Mobile-Security-Framework-MobSF
package
-
github.com
/pypa/advisory-database/tree/main/vulns/mobsf/PYSEC-2025-48.yaml
web
-
github.com
/advisories/GHSA-fcfq-m8p6-gw56
advisory
Sources
- CVE List CVE-2025-31116
- GitHub Advisory GHSA-fcfq-m8p6-gw56
- NVD CVE-2025-31116
- OSV PYSEC-2025-48
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.