@mobilenext/mobile-mcp alllows arbitrary file write via Path Traversal in mobile screen capture tools

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-33989 · Microsoft / collected KEV context

EUVD-2026-16882

GHSA-3p2m-h2v6-g9mx

cve-program · CVE-2026-33989

• https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-3p2m-h2v6-g9mx
• https://github.com/mobile-next/mobile-mcp/commit/f5e32295903128c1e71cf915ae6c0b76c7b0153b
• https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.49

euvd · EUVD-2026-16882

• https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-3p2m-h2v6-g9mx
• https://github.com/mobile-next/mobile-mcp/commit/f5e32295903128c1e71cf915ae6c0b76c7b0153b
• https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.49

nvd · CVE-2026-33989

• https://github.com/mobile-next/mobile-mcp/commit/f5e32295903128c1e71cf915ae6c0b76c7b0153b
• https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.49
• https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-3p2m-h2v6-g9mx

osv · GHSA-3p2m-h2v6-g9mx

• https://github.com/mobile-next/mobile-mcp/security/advisories/GHSA-3p2m-h2v6-g9mx
• https://nvd.nist.gov/vuln/detail/CVE-2026-33989
• https://github.com/mobile-next/mobile-mcp/commit/f5e32295903128c1e71cf915ae6c0b76c7b0153b
• https://github.com/mobile-next/mobile-mcp
• https://github.com/mobile-next/mobile-mcp/releases/tag/0.0.49

No related operational record is retained in the current change model.