The installer of Canon’s My Image Garden for macOS does not properly validate symbolic links present in its package. When a local user with login privileges installs a specially crafted symlink, the installer is tricked into modifying the permissions of files that the user would normally not have permission to alter. This flaw allows the attacker to gain unauthorized control over protected files, potentially facilitating further compromise or abuse. The weakness is identified as CWE-59, which involves improper handling of pathnames and symbolic links.

Canon Inc. sells My Image Garden for macOS, and versions 3.6.8 and earlier are affected by this vulnerability. No other products or version ranges are listed in the advisory.

The CVSS score for this vulnerability is 5.1, indicating moderate severity. EPSS information is not available, so the exact likelihood of exploitation in the wild cannot be quantified. The flaw is not currently listed in the CISA KEV catalog, suggesting no publicly known, active exploitation campaigns. The attack requires the attacker to be a local user with the ability to run the installer, meaning that restricting local installation privileges or using a secure installation process reduces risk.