PT-2026-42664 · Mvt · Mvt
CVE-2026-46486
·
Published
2026-05-21
·
Updated
2026-07-23
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
MVT (Mobile Verification Toolkit) versions prior to 2026.5.12
Description
A path traversal issue exists during iOS Backup processing due to unsanitized file identifiers. The
fileID field from the Manifest.db SQLite database is used directly in filesystem path construction without validation. This affects two commands through a shared code path: the 'mvt-ios decrypt-backup' command in decrypt.py uses file id to construct read source and write destination paths, allowing decrypted content to be written to arbitrary locations on the analyst's filesystem. The 'mvt-ios check-backup' command, via the get backup file from id() function in ios/modules/base.py, allows the unvalidated fileID to resolve to files outside the backup directory, which are then opened and parsed into JSON results and CSV timelines.Recommendations
Update to version 2026.5.12.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mvt