Tunnelblick’s tunnelblickd Unix socket is world‑accessible and lacks an authorization check, allowing any local user to send read requests to the helper binary. The helper constructs a path to the configuration file config.ovpn within a user‑controlled .tblk directory and reads it as root without verifying symbolic‑link validity. An attacker can place a symlink named config.ovpn that points to an arbitrary system file and ask tunnelblickd to read it, resulting in the disclosure of file contents that are normally protected at the root level. This weakness is a path‑trust violation classified as CWE‑61.

The vulnerability exists in Tunnelblick versions from 3.3beta26 up to and including 9.0beta01 on macOS. The flaw resides in the tunnelblick-helper binary, invoked through the tunnelblickd socket, and permits reading of any file a root‑owned system may contain. The restored socket mode of 0666 means that any user on the machine can connect without restriction.

The CVSS score of 6.8 indicates moderate overall severity. Attackers need local access to a device running the affected code and the ability to create a symlinked configuration file; no external network interaction is required. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. The impact is confined to confidentiality compromise of arbitrary root‑owned files and does not expose the system to further exploitation beyond reading those files.