CVE-2026-84598 in iOS
Summary
by MITRE • 09/15/2026
A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability described constitutes a critical path traversal flaw within the operating system's file handling mechanisms, specifically affecting iOS and iPadOS versions prior to 26.7 and 27. This security defect arises from insufficient validation of user-supplied input when processing file paths, allowing an attacker to manipulate directory navigation sequences such as dot-dot-slash characters to escape intended directories. By exploiting this lack of rigorous path normalization or sanitization, the application fails to restrict access strictly to its designated sandboxed environment, thereby violating the principle of least privilege that is fundamental to mobile operating system security architectures.
The operational impact of this vulnerability is severe due to the specific attack vector involving physical access combined with a trust-paired device status. In iOS and iPadOS ecosystems, when a user chooses to Trust a computer upon connection via USB or Lightning cable, the device grants elevated privileges for data synchronization and backup operations under the assumption that the host machine is secure and authorized by the owner. An attacker leveraging this trusted relationship can exploit the path traversal flaw to read sensitive files outside of the app sandbox, potentially accessing private user data such as messages, photos, credentials stored in keychains, or system configuration files. Furthermore, the ability to write arbitrary files introduces risks beyond mere information disclosure, including potential persistence mechanisms through malicious file injection or modification of critical system components if sufficient permissions are inadvertently exposed by the flaw.
From a classification perspective, this issue aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-73 External Control of File Name or Path within the Common Weakness Enumeration framework. The exploitation technique corresponds to ATT&CK tactic TA0001 Initial Access and specifically relates to techniques involving local file access, such as T1552 Unsecured Credentials if sensitive data is exfiltrated, though the primary mechanism here is unauthorized filesystem interaction rather than credential theft per se. The vulnerability highlights a failure in input validation controls that are typically enforced by security frameworks designed to prevent directory traversal attacks on mobile platforms where sandboxing is expected to be impenetrable from local processes unless explicitly authorized through higher-level APIs which were improperly secured in this instance.
Mitigation strategies for this vulnerability primarily involve the immediate application of the software updates provided by Apple, specifically iOS 26.7 and iPadOS 26.7 or later versions including iOS 27 and iPadOS 27. These updates contain improved path validation logic that correctly restricts file operations to authorized directories even when elevated privileges are granted through trust relationships. For organizations managing fleets of devices, ensuring timely patch deployment is critical to closing this gap in physical access security controls. Additionally, users should exercise caution when connecting untrusted or public computers to their devices and avoid selecting the Trust option unless they have verified the integrity and ownership of the host machine. Implementing strict device management policies that restrict USB accessory usage can also serve as a compensating control to reduce the attack surface for physical access-based exploits until patches are fully deployed across all endpoints.