mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
View on Github
Activity
- Latest release
- 1w ago
- Total releases
- 78
- Cadence
- ~13 days
- Last 12 months
- 7
Reach
- Stars
- 13.1k
Details
- License
- unknown
- First release
- Jul 18, 2021
| Version | Released | |
|---|---|---|
2026.9.7
patch
| ||
2026.9.1
minor
| ||
2026.7.29
minor
| ||
2026.6.29
minor
| ||
2026.5.12
minor
| ||
2026.4.28
major
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.7.0
minor
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.6.1
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.6.0
minor
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.5.4
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.5.3
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.5.2
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.5.1
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.5.0
minor
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.4.5
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.4.4
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.4.3
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.4.2
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.4.1
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.4.0
minor
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.3.0
minor
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.2.6
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.2.5
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.2.4
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.2.3
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.2.2
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.2.1
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.2
minor
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.1.6
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.1.5
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.1.4
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.1.3
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.1.2
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.1.1
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.1
minor
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.0.1
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
2.0
major
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
1.5.5
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
1.5.4
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
1.5.3
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
1.5.2
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
1.5.1
minor
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
1.4.11
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
1.4.10
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
1.4.9
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
1.4.8
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
1.4.7
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
1.4.6
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
1.4.5
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev | ||
1.4.4
patch
1 CVE
CVE-2026-46486
PYSEC-2026-2671
GHSA-5h3g-px23-w6vw
Jul 13, 2026
Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing
Medium
Network
Low
None
SummaryThe
ImpactFile write (decrypt-backup): An adversary delivering a crafted iOS backup can cause attacker controlled content to be written to arbitrary paths writable by the analyst process. This could be leveraged for code execution via shell profile modification or SSH key injection. Severity is assessed as Moderate because exploitation requires a specifically crafted malicious bundle to be parsed by the analyst. There are trust mitigations between stakeholders involved in the handoff of the sample that reduce the likelihood of this scenario. File read (check-backup): An adversary can force MVT to open and parse files outside the backup directory. Practical exploitation is reduced as it requires the attacker to know or guess the analyst’s directory layout for cross-case targeting, and the traversed file from the host must be a valid SQLite database or plist whose schema matches what the specific MVT module expects. Patched versionCreditsThis issue was identified during a security assessment conducted by 0xche. Affected versions
1.0.11
1.0.12
1.0.13
1.0.14
1.0.15
1.0.16
1.0.17
1.1.0
1.1.1
1.2.0
1.2.1
1.2.10
+ 61 more Show less
1.2.11
1.2.12
1.2.13
1.2.14
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.4.0
1.4.1
1.4.10
1.4.11
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
2.0
2.0.1
2.1
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.7.0
2026.4.28
Fixed in
2026.5.12
References Updated Jul 13, 2026 · Source: OSV.dev |