Opensecurity Mobile Security Framework 4.4.0
Approved changes feed: RSS · Atom
cpe:2.3:a:opensecurity:mobile_security_framework:4.4.0:*:*:*:*:*:*:*part: a version: 4.4.0 update: *
| Vendor | Opensecurity (d05db351-3ebf-5c51-ad9a-bfce83eb24c8) |
|---|---|
| Product | Mobile Security Framework (9a0c7b07-0a89-5982-ae04-6568806bca4e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/mobsf/mobile-security-framework-mobsf |
purl2cpe | 2026-07-28 16:41:06.918448 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-58162 |
vulnerable | 2026-06-08 07:35:17.379394 |
MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction
MEDIUM (6.5)
MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary files to any directory writable by the user of the MobSF process. This issue has been patched in version 4.4.1.
Published: 2025-09-02T00:46:06.864Z
Updated: 2025-09-02T13:29:01.717Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-58161 |
vulnerable | 2026-06-08 07:35:17.378920 |
MobSF Path Traversal in GET /download/<filename> using absolute filenames
MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from "neighboring" directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.
Published: 2025-09-02T00:45:49.996Z
Updated: 2025-09-02T19:25:49.966Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.