CVE-2026-20653: 
macOS vulnerability analysis and mitigation

CVE-2026-20653 is a path traversal vulnerability in Apple's Shortcuts application affecting multiple Apple operating systems. The flaw stems from a parsing issue in the handling of directory paths, which was addressed with improved path validation. Affected platforms include iOS and iPadOS (before 18.7.5 and before 26.3), macOS Sequoia (before 15.7.4), macOS Sonoma (before 14.8.4), macOS Tahoe (before 26.3), and visionOS (before 26.3). The vulnerability was disclosed and patched on February 11, 2026, and was discovered by Enis Maholli (enismaholli.com). It carries a CVSS v3.1 base score of 5.5 (Medium) (Apple Advisory iOS 26.3, Apple Advisory macOS Tahoe 26.3, Feedly).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — 'Path Traversal'). The root cause is a parsing flaw in how the Shortcuts application processes directory paths, allowing a malicious app to supply crafted path inputs that bypass intended directory restrictions. Exploitation requires local access and user interaction (e.g., a user running a malicious shortcut or app), and no elevated privileges are required. The fix involved implementing improved path validation logic within the Shortcuts component (Apple Advisory iOS 26.3, Apple Advisory macOS Tahoe 26.3, Feedly).

Successful exploitation allows a malicious app to access sensitive user data that would otherwise be restricted by the operating system's sandbox and file access controls. The impact is limited to confidentiality — there is no integrity or availability impact. The vulnerability does not enable remote code execution or lateral movement, but could expose private files, credentials, or personal data accessible through the Shortcuts app's directory traversal (Apple Advisory iOS 18.7.5, Apple Advisory visionOS 26.3, Feedly).

Apple has released patches addressing this vulnerability across all affected platforms. Users should update to the following versions or later: iOS 18.7.5, iPadOS 18.7.5, iOS 26.3, iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, and visionOS 26.3. Updates can be applied via Settings > General > Software Update on iOS/iPadOS, or System Settings > General > Software Update on macOS. No configuration-based workarounds have been published; upgrading to a patched version is the recommended remediation (Apple Advisory iOS 26.3, Apple Advisory iOS 18.7.5, Apple Advisory macOS Tahoe 26.3, Apple Advisory macOS Sequoia 15.7.4).

The vulnerability was credited to security researcher Enis Maholli (enismaholli.com) across all affected platforms. No significant public commentary, media coverage, or notable researcher discussion specific to CVE-2026-20653 has been identified beyond standard vulnerability tracking and aggregation sites (Apple Advisory iOS 26.3).