CVE-2026-33989
Mobile Next is an MCP server for mobile development and automation.
Published Mar 27, 2026 · updated Jun 17, 2026 · mobilenexthq mobile mcp
Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the server contains a Path Traversal vulnerability in the and tools. The and parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 27, 2026 · NIST NVD
Detected
Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the server contains a Path Traversal vulnerability in the and tools. The and parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue.
Jun 17, 2026 · NIST NVD
Updated
Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the server contains a Path Traversal vulnerability in the and tools. The and parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue.
Affected
- cpe mobilenexthq/mobile mcpversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33989
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33989
Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the server contains a Path Traversal vulnerability in the and tools. The and parameters
nvd.nist.gov