CVE-2026-33989
🟠 Łataj w tym tygodniu
Podatność Path Traversal w Mobile Next pozwala na zapis plików poza zamierzonym obszarem.
CVSS
8.1
EPSS
0.0%
Exploit
poc
Vendor
mobilenexthq
Opis źródłowy (NVD)
Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue.
exploit path-traversal
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 8.1 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.0% |
| Opublikowano (NVD) | 2026-03-27 22:16:22 UTC |
| Ostatnia modyfikacja (NVD) | 2026-03-31 21:52:33 UTC |
Referencje
- https://github.com/mobile-next/mobile-mcp/commit/f5e32295903128c1e71cf915ae6c0b76c7b0153b (security-advisories@github.com) [Patch]
- https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.49 (security-advisories@github.com) [Release Notes]
- https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-3p2m-h2v6-g9mx (security-advisories@github.com) [Exploit, Vendor Advisory]