CVE-2025-58162mediumCWE-22

CVE-2025-58162: falha de média gravidade em MobSF Mobile-Security-Framework-MobSF

MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction

Publicada em

Seguir esta CVE+ Monitorar Mobile-Security-Framework-MobSF+ Monitorar mobsf

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.6%
MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary files to any directory writable by the user of the MobSF process. This issue has been patched in version 4.4.1.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
MobSF · Mobile-Security-Framework-MobSF
CVEs relacionadas — MobSF Mobile-Security-Framework-MobSF

No mesmo produto, das mais perigosas para as menos.

CVE-2024-41955MEDIUMMobile Security Framework (MobSF) has an Open Redirect in Login RedirectEPSS 1.0%CVE-2024-43399HIGHMobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library FilesEPSS 1.0%CVE-2025-58161LOWMobSF Path Traversal in GET /download/<filename> using absolute filenamesEPSS 0.8%CVE-2024-29190HIGHMobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)EPSS 0.7%CVE-2026-68924MEDIUMMobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK ExtractionEPSS 0.6%CVE-2025-46730MEDIUMMobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death AttackEPSS 0.5%