Apple’s iPadOS and macOS systems contain a path traversal flaw tied to symlink validation. An application that can create or manipulate symbolic links may follow links that escape expected boundaries, allowing the app to read or write files it should not have access to. The primary impact is unauthorized access to protected user data, which could lead to confidentiality breaches or further exploitation. The weakness is identified as CWE‑59.

Affected devices run iPadOS 17.7.9 or earlier, macOS Sequoia 15.6 or earlier, macOS Sonoma 14.7.7 or earlier, and macOS Ventura 13.7.7 or earlier. Current releases of these operating systems incorporate defenses that mitigate the symlink validation issue.

The CVSS score of 9.8 marks this vulnerability as Critical, and the EPSS score of < 1% suggests a low probability of exploitation in the wild. The flaw is not currently listed in the CISA KEV catalog. The attack path is likely local: a malicious or compromised app on the device would need to leverage the symlink handling flaw to reach protected data. Given the OS-level nature of the flaw, successful exploitation would grant the attacker user‑level access to sensitive files and potentially compromise system integrity or availability.