A path handling issue was addressed with improved logic. This issue is fixed in visionOS 2.1, iOS 18.1 and iPadOS 18.1, macOS Ventura 13.7.1, macOS Sonoma 14.7.1, watchOS 11.1, tvOS 18.1. A malicious app may be able to run arbitrary shortcuts without user consent.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
| Link | Tags |
|---|---|
| https://support.apple.com/en-us/121570 | vendor advisory |
| https://support.apple.com/en-us/121566 | vendor advisory |
| https://support.apple.com/en-us/121568 | vendor advisory |
| https://support.apple.com/en-us/121569 | vendor advisory |
| https://support.apple.com/en-us/121565 | vendor advisory |
| https://support.apple.com/en-us/121563 | vendor advisory |