MobSF Vulnerability Allows Attackers to Upload Malicious Files

Critical security flaws in Mobile Security Framework MobSF version 4.4.0 allow authenticated users to exploit path traversal and arbitrary file write vulnerabilities, potentially compromising system integrity and exposing sensitive data. The flaws, tracked as CVE-2025-58161 and CVE-2025-58162, have been addressed in the patched version 4.4.1.

The issues stem from inadequate path validation in MobSF’s file handling, with the path traversal weakness (CVE-2025-58161) affecting the GET /download/<filename> endpoint by relying on string-based path checks and could let users access files from neighboring directories.

The arbitrary file write vulnerability (CVE-2025-58162) affects iOS static analysis where specially crafted .a archive files with absolute paths could overwrite critical files, including the database db.sqlite3 or web templates, enabling stored cross-site scripting and potential privilege escalation in misconfigured containers.

Both flaws require authenticated access to MobSF and have been mitigated in version 4.4.1, which implements proper path validation and normalisation and rejects absolute paths during archive extraction.