CVE-2025-58162: MobSF Arbitrary File Write Vulnerability via Absolute Path in .a Extraction
Summary
CVE-2025-58162: MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction. Affects mobsf versions < 4.4.1. Fixed in 4.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MobSF (Mobile Security Framework) is an open-source tool designed for static and dynamic analysis of mobile applications. It allows developers and security professionals to analyze the security posture of mobile apps by examining their code and behavior. The framework supports various file types, including statically linked libraries (.a files), which are essential for iOS applications. However, a vulnerability has been identified in the way MobSF handles the extraction of these .a files, potentially allowing unauthorized file writes.
Vulnerability Detail
The vulnerability arises from MobSF's handling of absolute file paths during the extraction of embedded objects from .a files. When an attacker uploads a specially crafted .a file containing absolute paths, MobSF can overwrite files outside its intended working directory. This occurs because the extraction function does not adequately validate the paths, allowing files to be written to arbitrary locations, such as system directories or critical application files. The implications include potential data loss, system malfunctions, and the risk of executing malicious code.
How To Fix
Latest published version: 4.5.3 as of 23 Oct 2026
pip install --upgrade "mobsf==4.5.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.4.1
This is the first release that contains the fix.
pip install --upgrade "mobsf==4.4.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid uploading .a files from untrusted sources. Additionally, implement file path validation in your application to reject absolute paths before processing the files.
Conclusion
The MobSF vulnerability CVE-2025-58162 poses significant risks due to its potential for arbitrary file writes. Users are strongly advised to update to the latest version to mitigate these risks. Additionally, employing best practices for file handling can further enhance security.
See every vulnerability recorded for mobsf →
FAQ
CVE-2025-58162 is a vulnerability in MobSF that allows arbitrary file writes due to improper handling of absolute paths in .a file extractions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized file overwrites, potential data loss, system malfunctions, and possible execution of malicious code.
You can update MobSF to the patched version by running the command: pip install --upgrade mobsf.
If you cannot update immediately, avoid uploading untrusted .a files and implement additional file path validation in your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for mobsf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
