CVE-2025-30465

CRITICAL

9.8

Description

A permissions issue was addressed with improved validation. This issue is fixed in iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sequoia 15.7.2, macOS Sonoma 14.7.5, macOS Sonoma 14.8.2, macOS Tahoe 26.1, macOS Ventura 13.7.5. A shortcut may be able to access files that are normally inaccessible to the Shortcuts app.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published3/31/2025

Last Modified4/2/2026

Sourcenvd

Honeypot Sightings0

Affected Products

apple:ipadosapple:macos

Weaknesses (CWE)

CWE-276

References

https://support.apple.com/en-us/122372(product-security@apple.com)

https://support.apple.com/en-us/122373(product-security@apple.com)

https://support.apple.com/en-us/122374(product-security@apple.com)

https://support.apple.com/en-us/122375(product-security@apple.com)

https://support.apple.com/en-us/125634(product-security@apple.com)

https://support.apple.com/en-us/125635(product-security@apple.com)

https://support.apple.com/en-us/125636(product-security@apple.com)

http://seclists.org/fulldisclosure/2025/Apr/10(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2025/Apr/5(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2025/Apr/8(af854a3a-2127-422b-91ae-364da2661108)

http://seclists.org/fulldisclosure/2025/Apr/9(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.