CVE-2025-58161 MobSF Path Traversal in GET /download/<filename> using absolute filenames
An authenticated attacker can download files outside the intended directory via path traversal in MobSF, leading to data leakage.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-58161?
CVE-2025-58161 is a low-severity path traversal vulnerability in Mobile-Security-Framework-MobSF, published on 2 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from "neighboring" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.
Weakness: CWE-22
Which versions are affected by CVE-2025-58161?
3 open source packages ship an affected version, including mobsf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mobsf PyPI | All versions | 4.4.1 |
mobsf PyPI | All versions | 4.4.1 |
mobsf PyPI | All versions | 4.4.1 |
Products include Opensecurity Mobile Security Framework.
How do I fix CVE-2025-58161?
Upgrade mobsf to 4.4.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-58161 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-58161 exists.
Other vulnerabilities in Mobile-Security-Framework-MobSF
- CVE-2025-46335 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload
- CVE-2025-24805 Local Privilege Escalation in MobSF
- CVE-2025-24803 Stored Cross-Site Scripting (XSS) in MobSF
- CVE-2026-24490 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
- CVE-2024-53999 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
Sources
Also known as GHSA-ccc3-fvfx-mw3v, PYSEC-2026-1672.