EUVD-2026-15077
GHSA-ggw7-c93j-879r
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Without a published CVSS score, EPSS probability, or KEV status, risk assessment relies on the vulnerability description and affected versions. The technical impact is severe—unauthorized file deletion can lead to data loss, system instability, or denial of service. The attack vector appears to be local (via a malicious application), likely requiring no special privileges to trigger, which increases real-world risk. The absence of CVSS/EPSS metrics suggests either incomplete disclosure or early-stage patching before widespread public analysis. However, the fact that Apple released patches across three major OS versions indicates this was treated as a high-priority security issue internally. The vulnerability is automatable (an app simply attempts deletion) and directly impacts system integrity. Under SSVC criteria, this warrants immediate patching due to technical impact (file deletion) and likely exploitation feasibility, even without confirmed active exploitation data. |
| Exploit ScenarioDerived | A malicious application disguised as a legitimate utility requests user installation. Once granted execution, the app exploits the path validation flaw to delete critical system files, user documents, or application data belonging to other users on the system without triggering permission denial errors. No elevated privileges or complex exploitation techniques are required—the flaw in path handling validation means the file system itself fails to properly enforce ownership checks during the deletion operation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
Unauthorized file deletion in macOS Sequoia, Sonoma, and Tahoe allows unprivileged applications to delete files without proper permissions due to insufficient path validation. An attacker could exploit this vulnerability through a malicious app to remove sensitive files outside the application's intended scope. This medium-severity local vulnerability affects multiple recent macOS versions and currently has no available patch.
Earlier versions of this analysis (1)
A path handling validation weakness in macOS allows applications to delete files without proper permission checks, enabling privilege escalation or data destruction attacks. This affects macOS Sequoia (before 15.7.5), macOS Sonoma (before 14.8.5), and macOS Tahoe (before 26.4). While no CVSS score or EPSS data is available, the vulnerability represents a critical integrity and confidentiality risk as unprivileged applications can circumvent file system access controls to delete protected files.
RemediationAI
Immediately update macOS Sequoia to version 15.7.5 or later, macOS Sonoma to version 14.8.5 or later, or macOS Tahoe to version 26.4 or later using System Settings > General > Software Update. Users unable to patch immediately should restrict untrusted application installations, monitor file system access logs via System Preferences, and consider implementing additional endpoint detection and response (EDR) tools to alert on suspicious file deletion patterns. Organizations should prioritize this patch given the severity of unauthorized file deletion and deploy updates across all affected systems within their standard critical patch windows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from insufficient validation in macOS path handling mechanisms, classified as a path traversal or authorization bypass issue. The affected technology spans the core macOS file system permission enforcement layer across multiple major versions (Sequoia 15.x, Sonoma 14.x, and the upcoming Tahoe 26.x release, as indicated by CPE cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*). The root cause involves inadequate validation of file paths before deletion operations, allowing applications to bypass the discretionary access control (DAC) checks that normally prevent unprivileged processes from deleting files owned by other users or the system. This is fundamentally an authorization/privilege management failure in the file system interaction layer.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to delete files for which it does not have permission.
Executive ViewAI
Organizations using A path handling should be aware of moderate risk from CVE-2026-28816, a path traversal vulnerability rated CVSS 4.0. This could allow unauthorized file access. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict file access via WAF, implement allowlists.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB