CVE-2025-58161: MobSF Path Traversal Vulnerability in GET /download/<filename>
Summary
CVE-2025-58161: MobSF Path Traversal in GET /download/ using absolute filenames. Affects mobsf versions < 4.4.1. Fixed in 4.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MobSF (Mobile Security Framework) is an open-source tool designed for mobile application security testing. It provides features for static and dynamic analysis of mobile apps, allowing developers and security professionals to identify vulnerabilities and improve the security posture of their applications. However, MobSF has a vulnerability that allows authenticated users to exploit file download functionality, potentially leading to unauthorized access to sensitive files.
Vulnerability Detail
The vulnerability arises from the GET /download/<filename> route, which employs string path verification using os.path.commonprefix. This method allows an authenticated user to download files from directories adjacent to the intended download directory, leading to a Directory Traversal attack. The flaw occurs because commonprefix compares raw strings rather than path components, allowing access to sibling directories that share the same prefix as the designated download directory. As a result, any authenticated user can retrieve files with allowed extensions from these neighboring directories, posing a significant data leak risk.
How To Fix
Latest published version: 4.5.3 as of 23 Oct 2026
pip install --upgrade "mobsf==4.5.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.4.1
This is the first release that contains the fix.
pip install --upgrade "mobsf==4.4.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in the download handler to ensure that the requested file is strictly within the designated download directory. For example, modify the is_safe_path function to include stricter path validation that checks for absolute paths and disallows any traversal attempts.
Conclusion
In summary, CVE-2025-58161 is a significant vulnerability in MobSF that allows authenticated users to exploit the file download functionality, leading to potential data leaks. It is crucial to update to the latest version of MobSF to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for mobsf →
FAQ
CVE-2025-58161 is a vulnerability in MobSF that allows authenticated users to exploit the file download functionality, potentially accessing sensitive files outside the intended directory.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The potential impacts include unauthorized access to sensitive files, data leaks, and compromise of application security, which could lead to further exploitation.
You can update MobSF to the patched version by running the command: pip install --upgrade mobsf in your terminal.
If immediate updates are not possible, implement stricter path validation in the download handler to mitigate the risk of unauthorized file access.
References
Related vulnerabilities
Recent vulnerabilities recorded for mobsf.
