Arbitrary file overwrite via nested traversal sequences

Path traversal in MobSF before 4.0.7 allows remote authenticated users to write files outside the extraction directory via a crafted .a archive. The ar_extract function removes traversal tokens only once, so nested sequences such as ....// collapse into ../ paths before file writes. Exploitation requires low-privileged access and a scan action; arbitrary overwrite can destroy the database or execute code under the service account.