CVE-2026-46486 Details
Description
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise. Prior to version 2026.5.12, there is a path traversal vulnerability via unsanitized File identifiers in iOS Backup processing. This issue has been patched in version 2026.5.12.
A path traversal vulnerability has been identified in MVT (Mobile Verification Toolkit) versions through 2026.4.28, specifically in the iOS Backup processing module. The vulnerability arises from unsanitized file identifiers used in the Manifest.db SQLite database of iOS backups, which are directly applied in filesystem path construction. This flaw affects the 'decrypt-backup' and 'check-backup' commands, allowing for unauthorized file read and write operations outside the intended backup directory.
Users can upgrade to MVT version 2026.5.12 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 8, 2026CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mvt-project/mvt/releases/tag/v2026.5.12 | [email protected] | Release NotesVendor |
| https://github.com/mvt-project/mvt/security/advisories/GHSA-5h3g-px23-w6vw | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MVT | <= 2026.4.28 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | New CVE Received | [email protected] |