What’s Vulnerable › Vulnerabilities

CVE-2026-46486: Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing

• Severity: medium (CVSS 5.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-08 · updated 2026-07-23
• Weakness: CWE-22

Description

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise. Prior to version 2026.5.12, there is a path traversal vulnerability via unsanitized File identifiers in iOS Backup processing. This issue has been patched in version 2026.5.12.

Affected products

• mvt-project mvt: before 2026.5.12

References

• https://github.com/mvt-project/mvt/releases/tag/v2026.5.12
• https://github.com/mvt-project/mvt/security/advisories/GHSA-5h3g-px23-w6vw

Get alerted when CVE-2026-46486 or the next vulnerability affects your stack