BaseFortify

Publication date: 2025-11-21

Last updated on: 2026-04-02

Assigner: Apple Inc.

Description

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access sensitive user data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-21

Last Modified

2026-04-02

Generated

2026-07-06

AI Q&A

2025-11-22

EPSS Evaluated

2026-07-05

NVD

CVE-2025-31248

Affected Vendors & Products

Vendor	Product	Version / Range
apple	macos	to 13.7.3 (exc)
apple	macos	From 14.0 (inc) to 14.7.3 (exc)
apple	macos	From 15.0 (inc) to 15.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a parsing issue in the handling of directory paths on macOS. It involves improper validation of directory paths, which could allow an application to access sensitive user data. The issue has been fixed by improving path validation in specific macOS versions.

Impact Analysis

An application exploiting this vulnerability may be able to access sensitive user data without proper authorization, potentially leading to privacy breaches or data leakage.

Mitigation Strategies

Update your macOS system to one of the fixed versions: macOS Ventura 13.7.3, macOS Sequoia 15.5, or macOS Sonoma 14.7.3 to address the parsing issue and prevent potential unauthorized access to sensitive user data.

Hi! I’m here to help you understand CVE-2025-31248. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70