MobSF Vulnerability Allows Attackers to Upload Malicious Files
Critical security vulnerabilities have been discovered in Mobile Security Framework (MobSF) version 4.4.0. These vulnerabilities permit authenticated attackers to exploit path traversal and arbitrary file write issues, potentially compromising system…
Critical security vulnerabilities have been discovered in Mobile Security Framework (MobSF) version 4.4.0. These vulnerabilities permit authenticated attackers to exploit path traversal and arbitrary file write issues, potentially compromising system integrity and exposing sensitive data.
Two significant vulnerabilities have been identified in the Mobile Security Framework (MobSF), an open-source mobile application security testing platform. These vulnerabilities, tracked as CVE-2025-58161 and CVE-2025-58162, affect MobSF version 4.4.0 and have been rectified in the updated version 4.4.1.
The security issues originate from inadequate path validation mechanisms within MobSF's file handling routines. The vulnerabilities allow authenticated users to access or modify files outside designated directories by exploiting weaknesses in the platform's path traversal protection.
CVE-2025-58161: Directory Traversal Vulnerability
This vulnerability involves a path traversal flaw in the GET /download/<filename> endpoint. The issue arises due to MobSF's reliance on os.path.commonprefix for path verification, which performs string-based comparisons instead of proper path analysis. Consequently, authenticated users can access files from directories with similar absolute paths to the intended download directory.
CVE-2025-58162: Arbitrary File Write Vulnerability
This more severe vulnerability enables arbitrary file writing through malicious .a archive files during iOS static analysis. Attackers can create specially crafted .a files containing members with absolute path names. This allows authenticated users to overwrite critical system files, inject malicious content, or cause system malfunctions.
Critical security vulnerabilities have been discovered in Mobile Security Framework (MobSF) version 4.4.0.
CVE-2025-58161 has been assigned a Low severity rating with a CVSS score of 0.0, as it permits data leakage from sibling directories with specific naming patterns. Conversely, CVE-2025-58162 carries a Moderate severity rating with a CVSS score of 6.0, due to its potential for system compromise.
Successful exploitation of CVE-2025-58162 can result in:
System malfunction through database corruption Analysis result tampering by overwriting artifacts Stored cross-site scripting via template modification Privilege escalation in misconfigured container environments
Both vulnerabilities require authenticated access to the MobSF platform, limiting immediate exploitability to users with valid credentials. The vulnerabilities were discovered by security researcher Vasily Leshchenko and have been addressed in MobSF version 4.4.1.
Organizations are strongly advised to upgrade to version 4.4.1, which implements proper path validation and normalization mechanisms. The patches address these vulnerabilities by:
Implementing proper path component comparison instead of string prefix matching Rejecting absolute paths in archive extraction routines Adding comprehensive path normalization before file operations
CVE ID Vulnerability Type Severity CVSS Score Affected Versions
CVE-2025-58161 Path Traversal Low 0.0/10 4.4.0
CVE-2025-58162 Arbitrary File Write (AR-Slip) Moderate 6.0/10 4.4.0
The discovery of these vulnerabilities underscores the importance of robust input validation and secure file handling practices in security analysis platforms. While the immediate risk is limited to authenticated users, the potential for system compromise highlights the critical need for timely security updates in enterprise security tools.
Based on reporting by GBHackers.