https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:53:29 +0000 https://cve.radiocsirt.org/vuln/cve-2025-58161 <p><strong>Affected:</strong> MobSF Mobile-Security-Framework-MobSF</p> <p>MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from &#34;neighboring&#34; directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.</p> <p><strong>Affected:</strong> MobSF Mobile-Security-Framework-MobSF</p> <p>MobSF is a mobile application security testing tool used. In version 4.4.0, the GET /download/ route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from &#34;neighboring&#34; directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak. This issue has been patched in version 4.4.1.</p> https://cve.radiocsirt.org/vuln/cve-2025-58161 https://cve.radiocsirt.org/vuln/ghsa-ccc3-fvfx-mw3v <p><strong>Affected:</strong> PyPI: mobsf</p> <p>### Summary The GET /download/&lt;filename&gt; route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from &#34;neighboring&#34; directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak.</p> <p>### Details ``` def is_safe_path(safe_root, check_path): safe_root = os.path.realpath(os.path.normpath(safe_root)) check_path = os.path.realpath(os.path.normpath(check_path)) return os.path.commonprefix([check_path, safe_root]) == safe_root ``` commonprefix compares raw strings, not path components. For: ``` safe_root = /home/mobsf/.MobSF/downloads check_path = /home/mobsf/.MobSF/downloads_bak/test.txt ``` the function returns True, incorrectly treating downloads_bak as inside downloads. Download handler: ``` # MobSF/views/home.py @login_required def download(request): root = settings.DWD_DIR filename = request.path.replace(&#39;/download/&#39;, &#39;&#39;, 1) dwd_file = Path(root) / filename # absolute &#39;filename&#39; ignores &#39;root&#39; if &#39;../&#39; in filename or not is_safe_path(root, dwd_file): return HttpResponseForbidden(...) ext = dwd_file.suffix if ext in settings.ALLOWED_EXTENSIONS and dwd_file.is_file(): return file_download(dwd_file, ...) ``` If the client supplies an absolute path in filename (starts with / or C:/), Path(root) / filename resolves to…</p> <p><strong>Affected:</strong> PyPI: mobsf</p> <p>### Summary The GET /download/&lt;filename&gt; route uses string path verification via os.path.commonprefix, which allows an authenticated user to download files outside the DWD_DIR download directory from &#34;neighboring&#34; directories whose absolute paths begin with the same prefix as DWD_DIR (e.g., .../downloads_bak, .../downloads.old). This is a Directory Traversal (escape) leading to a data leak.</p> <p>### Details ``` def is_safe_path(safe_root, check_path): safe_root = os.path.realpath(os.path.normpath(safe_root)) check_path = os.path.realpath(os.path.normpath(check_path)) return os.path.commonprefix([check_path, safe_root]) == safe_root ``` commonprefix compares raw strings, not path components. For: ``` safe_root = /home/mobsf/.MobSF/downloads check_path = /home/mobsf/.MobSF/downloads_bak/test.txt ``` the function returns True, incorrectly treating downloads_bak as inside downloads. Download handler: ``` # MobSF/views/home.py @login_required def download(request): root = settings.DWD_DIR filename = request.path.replace(&#39;/download/&#39;, &#39;&#39;, 1) dwd_file = Path(root) / filename # absolute &#39;filename&#39; ignores &#39;root&#39; if &#39;../&#39; in filename or not is_safe_path(root, dwd_file): return HttpResponseForbidden(...) ext = dwd_file.suffix if ext in settings.ALLOWED_EXTENSIONS and dwd_file.is_file(): return file_download(dwd_file, ...) ``` If the client supplies an absolute path in filename (starts with / or C:/), Path(root) / filename resolves to…</p> https://cve.radiocsirt.org/vuln/ghsa-ccc3-fvfx-mw3v