CVE-2025-58162

MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary files to any directory writable by the user of the MobSF process. This issue has been patched in version 4.4.1.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/7f3bc086c028c1b50889cab8a15f7b59b7abdaf9	Patch
https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.1	Release Notes
https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-9gh8-9r95-3fc3	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:opensecurity:mobile_security_framework:4.4.0:*:*:*:*:*:*:*

History

19 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) MobSF es una herramienta de prueba de seguridad de aplicaciones móviles utilizada. En la versión 4.4.0, un usuario autenticado que subió un one.a especialmente preparado, puede escribir archivos arbitrarios en cualquier directorio escribible por el usuario del proceso de MobSF. Este problema ha sido parcheado en la versión 4.4.1.

Information

Published : 2025-09-02 01:15

Updated : 2026-10-19 17:10

NVD link : CVE-2025-58162

Mitre link : CVE-2025-58162

CVE.ORG link : CVE-2025-58162

JSON object : View

Products Affected

opensecurity

mobile_security_framework

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-58162", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58162", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-02T13:28:52.324711Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "MobSF", "product": "Mobile-Security-Framework-MobSF", "versions": [{"status": "affected", "version": "= 4.4.0"}]}]}], "published": "2025-09-02T01:15:30.353", "references": [{"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/7f3bc086c028c1b50889cab8a15f7b59b7abdaf9", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-9gh8-9r95-3fc3", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary files to any directory writable by the user of the MobSF process. This issue has been patched in version 4.4.1."}, {"lang": "es", "value": "MobSF es una herramienta de prueba de seguridad de aplicaciones m\u00f3viles utilizada. En la versi\u00f3n 4.4.0, un usuario autenticado que subi\u00f3 un one.a especialmente preparado, puede escribir archivos arbitrarios en cualquier directorio escribible por el usuario del proceso de MobSF. Este problema ha sido parcheado en la versi\u00f3n 4.4.1."}], "lastModified": "2026-10-19T17:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opensecurity:mobile_security_framework:4.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "534D7FE5-0552-4B90-8460-03947501A10B"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}