Medium, CVSS 5.3PyPIAmendedPublished
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
CVE-2026-46486 · GHSA-5h3g-px23-w6vw
- Affected
- PyPI mvt <= 2026.4.28
- Fixed in
- 2026.5.12· Vendor fix available
- Issue
- The fileID field from Manifest.db (a SQLite database inside iOS backups, generated by the device) is used directly in filesystem path construction without validation. This affects two commands through a shared code path: - mvt-ios decrypt-backup (decrypt.py): fileid is used to construct both read source and write destination paths. Traversal sequences in fileid cause decrypted content to be written to an arbitrary location on the analyst's filesystem. - mvt-ios check-backup (via getbackupfilefromid() in ios/modules/base.py): the same unvalidated fileID resolves to files outside the backup directory, which are then opened and parsed. Parsed contents flow into JSON results and CSV timeline. Impact File write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is…
Recommended action: Upgrade to 2026.5.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.