CVE-2025-58162mediumCWE-22

CVE-2025-58162: fallo de gravedad media en MobSF Mobile-Security-Framework-MobSF

MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction

Publicada el

Seguir esta CVE+ Monitorear Mobile-Security-Framework-MobSF+ Monitorear mobsf

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.6%
MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary files to any directory writable by the user of the MobSF process. This issue has been patched in version 4.4.1.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Productos afectados
MobSF · Mobile-Security-Framework-MobSF
CVEs relacionadas — MobSF Mobile-Security-Framework-MobSF

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-41955MEDIUMMobile Security Framework (MobSF) has an Open Redirect in Login RedirectEPSS 1.0%CVE-2024-43399HIGHMobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library FilesEPSS 1.0%CVE-2025-58161LOWMobSF Path Traversal in GET /download/<filename> using absolute filenamesEPSS 0.8%CVE-2024-29190HIGHMobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)EPSS 0.7%CVE-2026-68924MEDIUMMobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK ExtractionEPSS 0.6%CVE-2025-46730MEDIUMMobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death AttackEPSS 0.5%