Executive brief
The Mobile Verification Toolkit (MVT), a tool used by forensic analysts to identify signs of compromise on mobile devices, contains a security flaw in how it processes iOS backups. An attacker could provide a specially crafted malicious backup file that, when analyzed, allows the attacker to read or write files on the investigator's computer. This could potentially lead to the theft of sensitive forensic data or allow the attacker to gain control over the analyst's system by overwriting critical configuration files.
Technical details
A path traversal vulnerability (CWE-22) exists in MVT due to the lack of sanitization of the 'fileID' field within the 'Manifest.db' SQLite database of iOS backups. In the 'mvt-ios decrypt-backup' command, this unsanitized input is used to construct filesystem paths, allowing an attacker to write decrypted content to arbitrary locations on the host. In the 'mvt-ios check-backup' command, the same flaw allows the tool to read and parse files outside the intended backup directory. Exploitation requires a user to process a maliciously crafted backup bundle. This issue is patched in version 2026.5.12.
Affected products
- mvt-project Mobile Verification Toolkit (MVT) <= 2026.4.28
Timeline
- 2026-05-12: patched: Version 2026.5.12 released
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-06-08: disclosed: CVE-2026-46486 published to NVD