MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from "neighboring" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.
References
Configurations
History
03 Sep 2025, 15:48
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Opensecurity
Opensecurity mobile Security Framework |
|
| References | () https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/7f3bc086c028c1b50889cab8a15f7b59b7abdaf9 - Patch | |
| References | () https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.1 - Release Notes | |
| References | () https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-ccc3-fvfx-mw3v - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| CPE | cpe:2.3:a:opensecurity:mobile_security_framework:4.4.0:*:*:*:*:*:*:* |
02 Sep 2025, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-02 01:15
Updated : 2025-09-03 15:48
NVD link : CVE-2025-58161
Mitre link : CVE-2025-58161
CVE.ORG link : CVE-2025-58161
JSON object : View
Products Affected
opensecurity
- mobile_security_framework
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')