Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processing

Vulnerability

Overview

The fileID field from Manifest.db (a SQLite database inside iOS backups) is used directly in filesystem path construction without validation [1][2]. This affects two commands: mvt-ios decrypt-backup and mvt-ios check-backup through a shared code path. In decrypt.py, the file_id is used to construct both read source and write destination paths, allowing traversal sequences to cause decrypted content to be written to arbitrary locations on the analyst's filesystem. In ios/modules/base.py, the _get_backup_file_from_id() function uses the same unvalidated fileID to resolve files outside the backup directory, which are then opened and parsed [1][2].

Exploitation

Conditions

For the file write scenario, an adversary must deliver a crafted iOS backup that includes traversal sequences in the fileID field. This requires the analyst to decrypt the backup using the tool. The written content is attacker-controlled, and could be leveraged for code execution (e.g., via shell profile modification or SSH key injection) [1]. For the file read scenario, the attacker must know or guess the analyst's directory layout, and the traversed file must be a valid SQLite database or plist matching the expected schema [1][2].

Impact

Successful exploitation allows arbitrary file write (potentially leading to code execution) or arbitrary file read (depending on the command used). The CVE is assessed as Moderate severity because exploiting it requires a specifically crafted malicious bundle and trust mitigations between analysts reduce likelihood [1][2].

Mitigation

The vulnerability is patched in MVT version 2026.5.12 [1][2][3]. Analysts should update to this version immediately and avoid processing iOS backups from untrusted sources without validation.