A path traversal vulnerability in the @mobilenext/mobile-mcp server allows unauthenticated attackers to perform unauthorized file write operations, posing a significant risk to system integrity.

This is a path traversal vulnerability (CWE-22) occurring in the mobile_save_screenshot and mobile_start_screen_recording tools. By failing to validate the saveTo and output parameters, the application allows an attacker to manipulate filesystem paths and write files to restricted directories.

Successful exploitation permits unauthorized file creation or overwriting, which can be leveraged to achieve arbitrary code execution or corrupt critical system configuration files. With a CVSS score of 8.1, this represents a high-severity risk that could lead to full system compromise and significant operational downtime.

Immediate Action: Update the @mobilenext/mobile-mcp package to version 0.0.49 or later immediately to incorporate the necessary input validation fixes.

Proactive Monitoring: Review system and application logs for unusual file write operations, specifically those involving directory traversal patterns like dot-dot-slash sequences.

Compensating Controls: Implement strict filesystem permissions for the service account running the MCP server to limit the impact of potential path traversal attempts.

Public Exploit Available: No (exploit_available: unknown).

Given the High severity of this vulnerability and the existence of a proof-of-concept, organizations should prioritize patching as a matter of urgency. Ensure all environments running the affected MCP server are updated to version 0.0.49 to eliminate the underlying path traversal flaw and prevent potential system compromise.