Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-33989: Mobile Screen Capture Tool Allows Unauthorized File Writing

CVE-2026-33989 · published 7 months ago

Summary

The mobile screen capture tool in @mobilenext/mobile-mcp allows an attacker to write files outside the intended workspace. This can lead to unauthorized file access or data tampering. Update to the latest version of @mobilenext/mobile-mcp to fix this issue.

What to do

Update mobilenext mobile-mcp to version 0.0.49.
Update mobilenexthq mobile_mcp to version 0.0.49 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	mobilenext	mobile-mcp	< 0.0.49 Fix: upgrade to 0.0.49
–	mobilenexthq	mobile_mcp	< 0.0.49 `cpe:2.3:a:mobilenexthq:mobile_mcp::::::node.js::*`

Original advisory text

@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools

Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue.

References

https://github.com/mobile-next/mobile-mcp/commit/f5e32295903128c1e71cf915ae6c0b7... Patch
https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.49 Release Notes
https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-3p2m-h2v6-g9m... Exploit Vendor Advisory
https://github.com/advisories/GHSA-3p2m-h2v6-g9mx
https://nvd.nist.gov/vuln/detail/CVE-2026-33989 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33989... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

CWE-73External Control of File Name or Path

Timeline

Published27 Mar 2026

Updated4 Nov 2026

First seen27 Mar 2026

Sources

GHSA-3p2m-h2v6-g9mx · GHSA

CVE-2026-33989 · NVD

CVE-2026-33989 · OSV

Track software like this

Free during beta