Directory Traversal Vulnerability in MobSF Mobile Application Security Testing Tool

CVE-2025-58161

What is CVE-2025-58161?

MobSF, a mobile application security testing framework, presents a directory traversal vulnerability in version 4.4.0. The flaw arises from improper handling of file path verification in the GET /download/ route, allowing an authenticated user to access files stored outside the designated download directory (DWD_DIR) by leveraging relative path structures. This could lead to unauthorized access to sensitive information, as users can retrieve files from adjacent directories that share a common prefix with the DWD_DIR path. The issue has been addressed in version 4.4.1, emphasizing the importance of timely updates to mitigate security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References