This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.1 and iPadOS 18.1, visionOS 2.1, macOS Sonoma 14.7.1, watchOS 11.1, tvOS 18.1. A malicious app may be able to access private information.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
| Link | Tags |
|---|---|
| https://support.apple.com/en-us/121570 | vendor advisory |
| https://support.apple.com/en-us/121566 | vendor advisory |
| https://support.apple.com/en-us/121569 | vendor advisory |
| https://support.apple.com/en-us/121565 | vendor advisory |
| https://support.apple.com/en-us/121563 | vendor advisory |