The mobile-next mobile-mcp server before version 0.0.49 contains a path traversal vulnerability (CWE-22) in its mobile_save_screenshot and mobile_start_screen_recording functionalities. Specifically, the parameters saveTo and output are passed directly to filesystem operations without validation, enabling an attacker to write files to arbitrary locations outside the restricted directory. This improper limitation of pathname can lead to unauthorized file writes, potentially impacting system integrity and availability. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, but high integrity and availability impact. The issue is resolved in version 0.0.49 of the product.

Exploitation of this vulnerability allows an unauthenticated attacker who can induce user interaction to write files outside the intended workspace. This can lead to unauthorized modification of files, potentially disrupting system operations or enabling further attacks. There is no direct confidentiality impact reported. The integrity and availability of the affected system can be significantly impacted.

Upgrade the mobile-next mobile-mcp server to version 0.0.49 or later, where this vulnerability is fixed. Since this is not a cloud service, remediation depends on applying the official fix. Patch status is confirmed by the vendor's versioning information. No other mitigations are indicated by the vendor advisory.