CVE-2025-43220

This issue was addressed with improved validation of symlinks

Critical · published July 29, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
57.7
In the wild
Unconfirmed
What it is

🔥 A sneaky validation flaw in symlinks could let an app access protected user data — that’s a major security oops! Think of it as a delivery service that doesn’t double-check the address on packages. If they’re not careful, they might accidentally hand over confidential information to the wrong person! 📦 With this vulnerability, an attacker could potentially access sensitive user files and data, leading to serious privacy breaches and data leaks. This could be absolutely devastating for individuals and organizations relying on their devices for secure operations.

Put simply

Think of it as a delivery service that doesn’t double-check the address on packages. If they’re not careful, they might accidentally hand over confidential information to the wrong person! 📦 This vulnerability stems from inadequate validation of symbolic links, allowing applications to access files they shouldn't be able to reach. Essentially, the system fails to check if the link points to a location outside of the intended directories.

What to do

With this vulnerability, an attacker could potentially access sensitive user files and data, leading to serious privacy breaches and data leaks. This could be absolutely devastating for individuals and organizations relying on their devices for secure operations. To protect yourself, update your devices immediately to iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, or macOS Ventura 13.7.7. Regularly check for updates and stay vigilant regarding app permissions and data access. You've got this! Stay secure by keeping your systems updated and you'll be a true security hero! 🦸‍♂️🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00847 · 57.7th percentile
Published
2025-07-29T23:29Z
EPSS history
Timeline
  • 29 JUL 23:29Z
    This issue was addressed with improved validation of symlinks
    cvelistv5