[Security] Fix Vulnerabilities Aug 2025 MobSF v4.4.1

[ajinabraham]

Describe the Pull Request

• Bump dependencies
• Fix Security Vulnerabilities reported by @noname1337h1
  • GHSA-9gh8-9r95-3fc3
  • GHSA-ccc3-fvfx-mw3v

Checklist for PR

• Run MobSF unit tests and lint tox -e lint,test
• Tested Working on Linux, Mac, Windows, and Docker
• Add unit test for any new Web API (Refer: StaticAnalyzer/tests.py)
• Make sure tests are passing on your PR

Additional Comments (if any)

DESCRIBE HERE

[github-actions]

👋 @ajinabraham
Thank you for sending this pull request ❤️.
Please make sure you have followed our contribution guidelines. We will review it as soon as possible

[Copilot]

Pull Request Overview

This PR addresses security vulnerabilities by fixing path traversal vulnerabilities and improving input validation throughout the MobSF codebase. The fixes enhance the is_safe_path function and implement better path traversal detection.

• Enhanced path traversal detection with URL decoding and absolute path checks
• Updated all is_safe_path function calls to include the raw filename parameter
• Added AR-slip protection for archive extraction

Reviewed Changes

Copilot reviewed 11 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
mobsf/MobSF/utils.py	Enhanced is_path_traversal function with URL decoding and absolute path detection
mobsf/StaticAnalyzer/views/ios/views/view_source.py	Updated is_safe_path call to include raw filename parameter
mobsf/StaticAnalyzer/views/android/views/view_source.py	Updated is_safe_path call to include raw filename parameter
mobsf/StaticAnalyzer/views/android/xapk.py	Updated multiple is_safe_path calls to include raw filename parameter
mobsf/StaticAnalyzer/views/common/shared_func.py	Added AR-slip protection and updated is_safe_path calls
mobsf/StaticAnalyzer/forms.py	Replaced inline path traversal check with is_path_traversal function
mobsf/MobSF/views/home.py	Updated is_safe_path call and removed redundant check
mobsf/DynamicAnalyzer/views/common/frida/views.py	Updated is_safe_path call to include raw filename parameter
mobsf/DynamicAnalyzer/views/common/device.py	Consolidated path traversal checks into single is_safe_path call
mobsf/MobSF/init.py	Version bump to 4.4.1
.github/SECURITY.md	Added security advisories for fixed vulnerabilities

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}