Vulnerability details

CVE-2026-33989

mobile-next mobile-mcp

@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools

CVSS 3.1

8.1High

Official description

Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue.

CVSS scores

Score	Version	Source	Vector
8.1High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
mobile-next	mobile-mcp	< 0.0.49	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-3p2m-h2v6-g9mx x_refsource_CONFIRM
https://github.com/mobile-next/mobile-mcp/commit/f5e32295903128c1e71cf915ae6c0b76c7b0153b x_refsource_MISC
https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.49 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-03-28
Last updated: 2026-03-30
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.49%

Probability of exploitation in 30 days

42.9%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73
External Control of File Name or Path