5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46486

CVE-2026-46486: Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise. Prior to version 2026.5.12, there is a path traversal vulnerability via unsanitized File identifiers in iOS Backup processing. This issue has been patched in version 2026.5.12.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46486

CVE-2026-46486:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mvt	pip	<= 2026.4.28	2026.5.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue (CWE-22) within the Mobile Verification Toolkit (MVT), originating from the direct use of the fileID field from an iOS backup's Manifest.db to construct filesystem paths. This fileID is device-controlled and can be manipulated by an attacker. The analysis of commit 2a3423d826f6453a28dc368f865632cacf02756a reveals that the developers patched this by adding validation to ensure the resolved file path is strictly within the intended parent directory, using Python's pathlib.Path.resolve() and is_relative_to() methods.

Two functions were identified as directly vulnerable:

Decryption.process_backup (src/mvt/ios/decrypt.py): This function is responsible for decrypting iOS backups. It was vulnerable to a file write path traversal because it used the unsanitized file_id to create both the source path for the encrypted file and the destination path for the decrypted output. An attacker could thereby write a file with controlled content to an arbitrary location on the analyst's machine, potentially leading to code execution.
IOSModule._get_backup_file_from_id (src/mvt/ios/modules/base.py): This is a utility function used by various analysis modules of the check-backup command. It was vulnerable to a file read path traversal. By crafting a malicious file_id, an attacker could trick MVT into reading and parsing arbitrary files from the analyst's filesystem, leading to information disclosure, assuming the file content was parsable by the specific MVT module.

Vulnerable functions

Decryption.process_backup

src/mvt/ios/decrypt.py

The `process_backup` function in the `Decryption` class constructs file paths for both reading and writing using the `file_id` field from an iOS backup's manifest. Before the patch, it did not validate or sanitize the `file_id`. A malicious backup could provide a `file_id` with path traversal sequences (e.g., '../../etc/passwd'), causing the function to write decrypted files to an arbitrary location on the analyst's filesystem.

IOSModule._get_backup_file_from_id

src/mvt/ios/modules/base.py

The `_get_backup_file_from_id` method in the `IOSModule` base class is used by various `check-backup` modules to locate files within the backup for analysis. It constructs a file path using the `file_id` from the manifest. A malicious `file_id` containing path traversal sequences could cause this function to return a path to a file outside the intended backup directory. This would lead to MVT opening and parsing unintended files from the analyst's filesystem.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.