https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 21:37:46 +0000 https://cve.radiocsirt.org/vuln/cve-2025-58161 <p><strong>Affected:</strong> MobSF Mobile-Security-Framework-MobSF</p> <p>MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from &#34;neighboring&#34; directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.</p> <p><strong>Affected:</strong> MobSF Mobile-Security-Framework-MobSF</p> <p>MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from &#34;neighboring&#34; directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.</p> https://cve.radiocsirt.org/vuln/cve-2025-58161