CVE-2025-30465

A permissions issue was addressed with improved validation

Critical · published March 31, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
64.3
In the wild
Unconfirmed
What it is

🚨 A shortcut could access your sensitive files without permission! This permissions issue is a critical flaw that can potentially expose your data in ways you never intended. 🔥 Think of it like a hotel clerk accidentally giving the wrong key for a room — a shortcut could access files that should be locked tight, sneaking in where it doesn't belong! 🏨 If exploited, this vulnerability allows unauthorized access to files that are normally off-limits to the Shortcuts app. This could lead to sensitive data leaks or manipulation of personal information without your knowledge, putting your privacy at serious risk. 🚨

Put simply

Think of it like a hotel clerk accidentally giving the wrong key for a room — a shortcut could access files that should be locked tight, sneaking in where it doesn't belong! 🏨 This vulnerability stems from inadequate validation of permissions, allowing unauthorized shortcuts to access restricted files on iPadOS and macOS devices. This means that a crafted shortcut can bypass intended security measures, posing a significant threat to user data.

What to do

If exploited, this vulnerability allows unauthorized access to files that are normally off-limits to the Shortcuts app. This could lead to sensitive data leaks or manipulation of personal information without your knowledge, putting your privacy at serious risk. 🚨 To protect yourself, update your devices to the latest versions: iPadOS 17.7.6, macOS Sequoia 15.4, 15.7.2, macOS Sonoma 14.7.5, 14.8.2, macOS Tahoe 26.1, or macOS Ventura 13.7.5. Don't wait too long—secure your devices today! 🛡️ You've got this! Follow these steps, and you'll ensure your data remains safe and sound. 💪✨

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01061 · 64.3th percentile
Published
2025-03-31T22:22Z
EPSS history
Timeline
  • 31 MAR 22:22Z
    A permissions issue was addressed with improved validation
    cvelistv5