CVE-2025-58161: MobSF Path Traversal Vulnerability

CVE-2025-58161 Overview

CVE-2025-58161 is a directory traversal vulnerability in Mobile Security Framework (MobSF), an open-source mobile application security testing tool. The flaw affects version 4.4.0 and resides in the GET /download/ route. The route uses os.path.commonprefix for path verification, which performs string-level comparison rather than filesystem-aware validation. An authenticated user can retrieve files from directories whose absolute paths share a prefix with the intended DWD_DIR download directory, such as downloads_bak or downloads.old. The issue is tracked under [CWE-22 Path Traversal] and was patched in MobSF version 4.4.1.

Critical Impact
Authenticated attackers can read files from neighboring directories on the MobSF host, leading to disclosure of backup archives, artifacts, and other sensitive data stored adjacent to the sanctioned download directory.

Affected Products

OpenSecurity Mobile Security Framework (MobSF) 4.4.0
Deployments exposing the /download/ route to authenticated users
Installations with neighboring directories sharing the DWD_DIR path prefix

Discovery Timeline

2025-09-02 - CVE-2025-58161 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58161

Vulnerability Analysis

MobSF exposes an authenticated GET /download/ endpoint that serves files from the configured DWD_DIR download directory. Before serving a requested file, the handler validates the resolved path against DWD_DIR using Python's os.path.commonprefix. This function compares strings character by character and does not respect filesystem boundaries. Two distinct directories that share an identical leading substring will pass the check even though one lies outside the intended root.

For example, if DWD_DIR resolves to /home/mobsf/downloads, then paths such as /home/mobsf/downloads_bak/report.pdf or /home/mobsf/downloads.old/keys.json also match the common prefix. An authenticated user can therefore request files from those adjacent directories through the download route, resulting in unauthorized data disclosure.

Root Cause

The root cause is misuse of os.path.commonprefix for security-sensitive path containment. The correct primitive is os.path.commonpath, which operates on path components, or an explicit is_safe_path check that resolves symlinks and verifies the target lives beneath the intended parent. The patched release replaces the string-prefix check with is_safe_path semantics for download-related routes.

Attack Vector

Exploitation requires valid authenticated access to the MobSF instance and network reachability to the web interface. An attacker crafts a request to /download/ referencing a file located in a sibling directory whose absolute path begins with the same prefix as DWD_DIR. Because the endpoint returns file content directly, the attacker retrieves the file over HTTP without further interaction.

python

# Patch excerpt: mobsf/DynamicAnalyzer/views/common/device.py
 )
 from mobsf.MobSF.utils import (
     is_md5,
-    is_path_traversal,
     is_safe_path,
     print_n_send_error_response,
     read_sqlite,

# Patch excerpt: mobsf/DynamicAnalyzer/views/common/frida/views.py
         script_ct = []
         for script in scripts:
             script_file = others / f'{script}.js'
-            if not is_safe_path(str(others), str(script_file)):
+            if not is_safe_path(str(others), str(script_file), script):
                 data = {
                     'status': 'failed',
                     'message': 'Path traversal detected.'}
# Source: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/7f3bc086c028c1b50889cab8a15f7b59b7abdaf9

Detection Methods for CVE-2025-58161

Indicators of Compromise

HTTP GET /download/ requests referencing filenames that resolve outside the sanctioned DWD_DIR directory.
Access log entries showing successful downloads with unusual file extensions such as .bak, .old, .sqlite, or archive formats not produced by MobSF scans.
Sequential download requests from a single authenticated session enumerating file names in neighboring directories.

Detection Strategies

Instrument the MobSF web server to log the fully resolved absolute path served by the /download/ handler and alert when it falls outside DWD_DIR.
Compare request parameters to a known allowlist of MobSF-generated report and artifact filenames; flag deviations.
Review authentication logs for accounts issuing high volumes of download requests, particularly from unexpected source addresses.

Monitoring Recommendations

Forward MobSF application logs and reverse-proxy access logs to a centralized logging platform for retention and query.
Baseline normal download activity by user and alert on statistical outliers in request volume or file naming patterns.
Monitor filesystem access on the MobSF host for reads of files adjacent to DWD_DIR originating from the MobSF service account.

How to Mitigate CVE-2025-58161

Immediate Actions Required

Upgrade MobSF to version 4.4.1 or later, which replaces the vulnerable os.path.commonprefix check with is_safe_path validation.
Restrict network access to the MobSF interface to trusted administrators until the upgrade is completed.
Audit directories adjacent to DWD_DIR on the MobSF host and remove or relocate any sensitive backups or artifacts.

Patch Information

The fix is delivered in MobSF Release v4.4.1. The relevant code change is documented in GitHub commit 7f3bc08 and the coordinated disclosure is published as GitHub Security Advisory GHSA-ccc3-fvfx-mw3v. Administrators should validate the upgrade by confirming that the running instance reports version 4.4.1 in the web UI.

Workarounds

Rename or relocate any neighboring directory whose absolute path shares a leading substring with DWD_DIR so no filesystem sibling matches the prefix.
Place MobSF behind a reverse proxy that rejects requests to /download/ containing path separators or filenames not matching an approved pattern.
Limit MobSF accounts to trusted operators and rotate credentials of accounts that may have been used to test the endpoint.

bash

# Example: verify installed MobSF version and isolate neighboring directories
pip show mobsf | grep -i version

# Move sibling directories that share the DWD_DIR prefix out of the parent path
mv /home/mobsf/downloads_bak /var/backups/mobsf_downloads_bak
mv /home/mobsf/downloads.old /var/backups/mobsf_downloads_old