CVE-2025-43417CWE-22path-traversal

CVE-2025-43417

Medium · published February 12, 2026

CVSS v3.1

5.5

EPSS

Percentile

14.0

In the wild

Unconfirmed

What it is

A path handling issue was addressed with improved logic. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2. An app may be able to access user-sensitive data.

The record

Technical detail

CVSS v3.1: 5.5 · MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00237 · 14.0th percentile
Weakness: CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published: 2026-02-12T04:16Z

Affected products (1)

Product	Versions	Fixed in
apple/macos	< 14.8.4	14.8.4

References (3)

https://support.apple.com/en-us/125886 · [email protected]https://support.apple.com/en-us/126349 · [email protected]https://support.apple.com/en-us/126350 · [email protected]

EPSS history

Timeline

11 FEB 22:58Z
A path handling issue was addressed with improved logic
cvelistv5