CVE-2025-58161

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-58161
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-58161.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-58161
Aliases
Published
2025-09-02T00:45:49.996Z
Modified
2025-12-05T10:20:37.919877Z
Severity
  • 1.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
MobSF Path Traversal in GET /download/<filename> using absolute filenames
Details

MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWDDIR download directory from "neighboring" directories whose absolute paths begin with the same prefix as DWDDIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58161.json",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/mobsf/mobile-security-framework-mobsf

Affected ranges

Type
GIT
Repo
https://github.com/mobsf/mobile-security-framework-mobsf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7f3bc086c028c1b50889cab8a15f7b59b7abdaf9

Affected versions

0.*

0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.8.1
0.8.8.2
0.9
0.9.1

v0.*

v0.9.2
v0.9.3
v0.9.3.1
v0.9.3.2
v0.9.3.3
v0.9.3.4
v0.9.3.5
v0.9.3.6
v0.9.3.7
v0.9.4
v0.9.4.1
v0.9.4.2
v0.9.5
v0.9.5.2
v0.9.5.4
v0.9.5.5

v1.*

v1.0.3Beta
v1.1.5
v1.1.6

v2.*

v2.0.0

v3.*

v3.0.0
v3.0.1
v3.0.5
v3.1.1
v3.2.6
v3.2.8
v3.2.9
v3.3.3
v3.3.5
v3.4.0
v3.4.3
v3.4.6
v3.5.0
v3.6.0
v3.6.9
v3.7.6
v3.9.7

v4.*

v4.0.7
v4.1.3
v4.3.0
v4.3.2