A path traversal flaw in macOS allows an application to access files outside its sandboxed environment. This vulnerability could enable an attacker to read or modify sensitive data that should be restricted to the sandbox, effectively eroding the isolation boundaries that macOS enforces for applications. The weakness is classified as a classic path traversal issue, compromising confidentiality and potentially integrity of protected files.

Apple macOS is affected. The defect is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Any earlier releases of these macOS versions that have not applied these updates remain vulnerable.

The vulnerability was addressed by improved input validation; the EPSS score is < 1% and KEV is not listed, indicating limited public exploitation data. The likely attack vector is local, requiring the attacker to run a malicious application or exploit the flaw in a legitimate application that runs with user privileges. Without a published exploit or high EPSS score, the risk is moderate but still significant enough to warrant patching.