The server contains a Path Traversal vulnerability that allows unvalidated use of the `saveTo` and `output` parameters in the mobile screen capture tools. Attackers can supply arbitrary file paths, causing the server to write or overwrite files outside the intended workspace. This could permit the insertion of malicious files or loss of crucial configuration, undermining confidentiality, integrity, and potentially availability of the application.

Mobile Next's MCP server, known as mobile-mcp, is vulnerable in all releases before version 0.0.49. Deployments running 0.0.48 or earlier expose the screen capture endpoints without path validation, whereas version 0.0.49 and later contain the fix.

The CVSS score of 8.1 indicates high severity. The EPSS score below 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote exploitation of the exposed MCP screen capture endpoints; an attacker must reach the server to supply malicious file path parameters. Once exploited, the attacker can write arbitrary files to the server filesystem.