CVE-2025-58162CWE-22path-traversal

CVE-2025-58162

Medium · published September 2, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
48.0
In the wild
Unconfirmed
What it is

MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary files to any directory writable by the user of the MobSF process. This issue has been patched in version 4.4.1.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00600 · 48.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-09-02T05:15Z
Affected products (1)
ProductVersionsFixed in
opensecurity/mobile_security_frameworkall versions—
References (3)
https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/7f3bc086c028c1b50889cab8a15f7b59b7abdaf9 · [email protected]https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.1 · [email protected]https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-9gh8-9r95-3fc3 · [email protected]
EPSS history
Timeline
  • 02 SEP 00:46Z
    MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction
    cvelistv5