PyPI/mobsf CVE-2025-58161: medium 4.3, EPSS 0.80%

MobSF Path Traversal in GET /download/<filename> using absolute filenames

Action: Upgrade mobsf to 4.4.1 or later.

pip install mobsf==4.4.1

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1672
• nvd: CVE-2025-58161
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-ccc3-fvfx-mw3v
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/7f3bc086c028c1b50889cab8a15f7b59b7abdaf9
• https://github.com/MobSF/Mobile-Security-Framework-MobSF
• https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.1
• https://pypi.org/project/mobsf
• https://github.com/advisories/GHSA-ccc3-fvfx-mw3v

CVE-2025-58161 · published 2026-07-07T16:03:03.065548Z · modified 2026-07-07T17:47:05.862226919Z · JSON