Description
Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue.
Published: 2026-03-27
Score: 8.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-3p2m-h2v6-g9mx @mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools
History

Sat, 28 Mar 2026 03:15:00 +0000

Type Values Removed Values Added
Description Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue.
Title @mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools
Weaknesses CWE-22
CWE-73
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-27T22:03:01.801Z

Reserved: 2026-03-24T22:20:06.211Z

Link: CVE-2026-33989

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-03-27T22:16:22.950

Modified: 2026-03-27T22:16:22.950

Link: CVE-2026-33989

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses