CVE-2026-33989CWE-22CWE-73

@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools

High · published March 27, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
43.2
In the wild
Unconfirmed
What it is

Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00518 · 43.2th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-73 · External Control of File Name or Path
Published
2026-03-27T22:03Z
EPSS history
Timeline
  • 27 MAR 22:03Z
    @mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools
    cvelistv5