CVE-2025-30450

macOS Symlink Validation Flaw Allowing Unauthorized Data Access

View on CVE.org
Published Mar 31, 2025 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Description
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access sensitive user data.

Analysis

AI-generated

Technical impact

A flaw in macOS where symlink validation lacks proper checks (CWE-284) enables an application to read files that a user should not access, potentially exposing sensitive data.

Affected Systems

Apple devices running macOS before macOS Sequoia 15.4, macOS Sonoma 14.7.5, or macOS Ventura 13.7.5 are affected; these versions do not contain the improved symlink validation introduced in the listed releases.

Risk and Exploitability

The CVSS score is 5.5, indicating moderate risk, while an EPSS score of less than 1% suggests a low probability of active exploitation at present and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that exploitation requires an attacker to run a malicious application locally, which can create or exploit a symlink to a protected file, thereby gaining unauthorized access to confidential data.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest macOS update—at least macOS Sequoia 15.4, macOS Sonoma 14.7.5, or macOS Ventura 13.7.5—to receive the symlink validation fix.
  • Review and follow Apple support articles 122373, 122374, and 122375 for detailed update procedures and verification steps.
  • If an immediate upgrade is not feasible, restrict execution of untrusted applications that may create symlinks to sensitive locations by using app sandboxing or stricter file‑system permissions.

Generated by OpenCVE AI on April 28, 2026 at 18:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-8914 This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access sensitive user data.
History
Type Values Removed Values Added
Title macOS Symlink Validation Flaw Allowing Unauthorized Data Access
Type Values Removed Values Added
Description This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access sensitive user data. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access sensitive user data.
Type Values Removed Values Added
First Time appeared Apple
Apple macos
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access sensitive user data.
References
Earlier changes (1)
Weaknesses

Sources

Status
PUBLISHED
Assigner
apple
Published
Updated
Apr 2, 2026, 6:25 PM
Reserved
Mar 22, 2025, 12:04 AM

View source JSON

Updated
Apr 1, 2025, 3:37 PM

JSON

Status
Modified
Published
Mar 31, 2025, 11:15 PM
Modified
Jun 17, 2026, 9:08 AM

View source JSON

No data.

Updated
Apr 28, 2026, 7:00 PM

JSON