{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33989", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-24T22:20:06.211Z", "datePublished": "2026-03-27T22:03:01.801Z", "dateUpdated": "2026-03-30T15:47:00.925Z"}, "containers": {"cna": {"title": "@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-3p2m-h2v6-g9mx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-3p2m-h2v6-g9mx"}, {"name": "https://github.com/mobile-next/mobile-mcp/commit/f5e32295903128c1e71cf915ae6c0b76c7b0153b", "tags": ["x_refsource_MISC"], "url": "https://github.com/mobile-next/mobile-mcp/commit/f5e32295903128c1e71cf915ae6c0b76c7b0153b"}, {"name": "https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.49", "tags": ["x_refsource_MISC"], "url": "https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.49"}], "affected": [{"vendor": "mobile-next", "product": "mobile-mcp", "versions": [{"version": "< 0.0.49", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T22:03:01.801Z"}, "descriptions": [{"lang": "en", "value": "Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue."}], "source": {"advisory": "GHSA-3p2m-h2v6-g9mx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-30T15:46:47.644516Z", "id": "CVE-2026-33989", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T15:47:00.925Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33989", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T15:46:47.644516Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T15:46:54.514Z"}}], "cna": {"title": "@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools", "source": {"advisory": "GHSA-3p2m-h2v6-g9mx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "mobile-next", "product": "mobile-mcp", "versions": [{"status": "affected", "version": "< 0.0.49"}]}], "references": [{"url": "https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-3p2m-h2v6-g9mx", "name": "https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-3p2m-h2v6-g9mx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mobile-next/mobile-mcp/commit/f5e32295903128c1e71cf915ae6c0b76c7b0153b", "name": "https://github.com/mobile-next/mobile-mcp/commit/f5e32295903128c1e71cf915ae6c0b76c7b0153b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.49", "name": "https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.49", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T22:03:01.801Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33989", "state": "PUBLISHED", "dateUpdated": "2026-03-30T15:47:00.925Z", "dateReserved": "2026-03-24T22:20:06.211Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-27T22:03:01.801Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue."}], "id": "CVE-2026-33989", "lastModified": "2026-03-30T13:26:07.647", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-03-27T22:16:22.950", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/mobile-next/mobile-mcp/commit/f5e32295903128c1e71cf915ae6c0b76c7b0153b"}, {"source": "security-advisories@github.com", "url": "https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.49"}, {"source": "security-advisories@github.com", "url": "https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-3p2m-h2v6-g9mx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.0.49)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "mobile-mcp", "source": "cna", "vendor": "mobile-next"}, "product": "mobile-mcp", "vendor": "mobile-next"}], "analysis": {"en": {"generated_at": "2026-03-28T06:11:06.872744+00:00", "value": {"mitigation_remediation": ["Upgrade the MCP server to version 0.0.49 or later, which contains the fix.", "If an upgrade cannot be performed immediately, restrict network access to the MCP server to trusted hosts only, limiting external exposure.", "Disable or monitor the mobile_save_screenshot and mobile_start_screen_recording APIs, ensuring they are only reachable by trusted applications or users."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary file write"}, "threat_synthesis": {"affected_systems": "The affected product is Mobile Next\u2019s MCP server, specifically all releases prior to version 0.0.49. Any deployment that exposes the mobile_save_screenshot or mobile_start_screen_recording API endpoints is at risk.", "description_and_impact": "The vulnerability exists in the mobile screen capture utilities of the MCP server, where the saveTo and output parameters are forwarded directly to the file system without validation. This omission permits an attacker to create or overwrite any file in the host system by supplying a crafted path. Based on the description, it is inferred that writing an executable or critical configuration file could allow malicious code to be executed later by privileged processes or services.", "risk_and_exploitability": "The CVSS base score of 8.1 indicates a high severity flaw. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, meaning no confirmed commercial exploitation yet. The likely attack vector is the exposed API endpoints; an attacker with network access to the MCP server can craft a request containing a malicious file path, thereby writing unintended files to the host."}}}}, "created": "2026-03-29T20:29:32.518564+00:00", "updated": "2026-03-30T06:59:58.111100+00:00", "vendors": ["mobile-next", "mobile-next$PRODUCT$mobile-mcp"]}