CVE-2026-43732

MEDIUM

Apple Safari - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Title source: rule

Description

A path handling issue was addressed with improved validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may disclose sensitive user information.

References (3)

Core 3

Core References

https://support.apple.com/en-us/127594

https://support.apple.com/en-us/127595

https://support.apple.com/en-us/127685

Scores

CVSS v3 6.5

EPSS 0.0026

EPSS Percentile 16.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (7)

Apple/iOS and iPadOS < 26.5.2

apple/ipados < 26.5.2

apple/iphone_os < 26.5.2

Apple/macOS < 26.5.2

apple/macos 26.0 - 26.5.2

Apple/Safari < 26.5.2

apple/safari < 26.5.2

Published Jun 29, 2026

Tracked Since Jun 30, 2026