CVE-2025-58162

{
  "id": "CVE-2025-58162",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-02T01:15:30.353",
  "lastModified": "2026-10-19T17:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MobSF is a mobile application security testing tool used. In version 4.4.0, an authenticated user who uploaded a specially prepared one.a, can write arbitrary files to any directory writable by the user of the MobSF process. This issue has been patched in version 4.4.1."
    },
    {
      "lang": "es",
      "value": "MobSF es una herramienta de prueba de seguridad de aplicaciones móviles utilizada. En la versión 4.4.0, un usuario autenticado que subió un one.a especialmente preparado, puede escribir archivos arbitrarios en cualquier directorio escribible por el usuario del proceso de MobSF. Este problema ha sido parcheado en la versión 4.4.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "MobSF",
          "product": "Mobile-Security-Framework-MobSF",
          "versions": [
            {
              "version": "= 4.4.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-02T13:28:52.324711Z",
          "id": "CVE-2025-58162",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:opensecurity:mobile_security_framework:4.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "534D7FE5-0552-4B90-8460-03947501A10B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/7f3bc086c028c1b50889cab8a15f7b59b7abdaf9",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.4.1",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-9gh8-9r95-3fc3",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}