CVE-2025-58162: Mobile Security Framework Path Traversal

CVE-2025-58162 Overview

CVE-2025-58162 is a path traversal vulnerability [CWE-22] in Mobile Security Framework (MobSF) version 4.4.0. An authenticated user can upload a specially crafted .a file that bypasses path validation and writes arbitrary files to any directory writable by the MobSF process user. The flaw resides in the dynamic analyzer's Frida script handling logic, where the is_safe_path check did not account for the user-controlled script name. The maintainers patched the issue in MobSF version 4.4.1 by extending the path validation function to include the script identifier.

Critical Impact
Authenticated attackers can write arbitrary files to any location writable by the MobSF service account, enabling code execution, configuration tampering, and integrity compromise of the security testing platform.

Affected Products

OpenSecurity Mobile Security Framework (MobSF) 4.4.0
MobSF Dynamic Analyzer component (mobsf/DynamicAnalyzer/views/common/frida/views.py)
MobSF device handling module (mobsf/DynamicAnalyzer/views/common/device.py)

Discovery Timeline

2025-09-02 - CVE-2025-58162 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58162

Vulnerability Analysis

The vulnerability exists in the Frida script loading routine of the MobSF Dynamic Analyzer. When a user requests execution of an auxiliary script, the code constructed a file path from the user-supplied script name and validated it with is_safe_path. The validation only compared the resolved script file path against the base directory but did not incorporate the raw script identifier itself. An authenticated user could supply a script name containing traversal sequences or a specially prepared .a payload that escaped the intended directory. The result is arbitrary file write to any location accessible to the MobSF process account. Because MobSF is often deployed with elevated privileges to inspect mobile binaries, this write primitive can be pivoted into code execution by overwriting application files, Python modules, or cron entries.

Root Cause

The root cause is incomplete input validation in the is_safe_path helper. The prior signature accepted only the base directory and the resolved file path, leaving the untrusted script identifier outside of policy evaluation. Traversal characters within the script name were not normalized before path construction.

Attack Vector

Exploitation requires an authenticated MobSF session with permissions to trigger dynamic analysis. The attacker submits a request referencing a script name that resolves outside the intended others directory. Because the check operates on the joined path rather than the script token, malicious inputs bypass the guard and reach the file write routine.

python

# Patch: mobsf/DynamicAnalyzer/views/common/frida/views.py
        script_ct = []
        for script in scripts:
            script_file = others / f'{script}.js'
-            if not is_safe_path(str(others), str(script_file)):
+            if not is_safe_path(str(others), str(script_file), script):
                data = {
                    'status': 'failed',
                    'message': 'Path traversal detected.'}
# Source: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/7f3bc086c028c1b50889cab8a15f7b59b7abdaf9

python

# Patch: mobsf/DynamicAnalyzer/views/common/device.py
 from mobsf.MobSF.utils import (
     is_md5,
-    is_path_traversal,
     is_safe_path,
     print_n_send_error_response,
     read_sqlite,
# Source: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/7f3bc086c028c1b50889cab8a15f7b59b7abdaf9

Detection Methods for CVE-2025-58162

Indicators of Compromise

Unexpected files written outside the MobSF uploads/ and downloads/ directories by the MobSF process user.
HTTP requests to dynamic analyzer endpoints containing .., URL-encoded traversal sequences, or unusual .a file uploads.
New or modified Python files, cron jobs, or startup scripts owned by the MobSF service account.
MobSF log entries referencing script names outside the expected inventory of built-in Frida scripts.

Detection Strategies

Monitor MobSF web access logs for POST requests to Frida-related endpoints with script parameters containing path separators or traversal tokens.
Alert on file integrity changes in system directories that correlate temporally with MobSF authenticated sessions.
Baseline the set of valid script identifiers in the others directory and flag deviations at request time.

Monitoring Recommendations

Enable audit logging on the host running MobSF to record file writes performed by the MobSF process.
Track authentication events into MobSF and correlate privileged actions with the originating user identity.
Review the GitHub Security Advisory GHSA-9gh8-9r95-3fc3 for vendor-published details.

How to Mitigate CVE-2025-58162

Immediate Actions Required

Upgrade MobSF to version 4.4.1 or later using the MobSF v4.4.1 Release.
Rotate any credentials, API keys, or session tokens stored on the MobSF host if compromise is suspected.
Audit the MobSF install directory and process-writable paths for unexpected files created since deployment of 4.4.0.
Restrict MobSF user accounts to trusted analysts and enforce strong authentication on the web interface.

Patch Information

The fix is delivered in MobSF 4.4.1 via commit 7f3bc086. The patch updates is_safe_path to also evaluate the raw script identifier and removes the deprecated is_path_traversal helper from device.py, consolidating validation logic.

Workarounds

Run the MobSF service under a dedicated low-privilege account with write access limited to the MobSF working directories.
Deploy MobSF inside a container or sandbox to constrain the blast radius of arbitrary file writes.
Place MobSF behind an authenticating reverse proxy and disable public network exposure until patched.

bash

# Upgrade MobSF to the patched release
git fetch --tags
git checkout v4.4.1
pip install -r requirements.txt
./run.sh 127.0.0.1:8000