CVE-2021-30855 Path traversal in macOS

What is CVE-2021-30855?

CVE-2021-30855 is a medium-severity path traversal vulnerability in Apple Ipados, published on 24 Aug 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, iOS 15 and iPadOS 15, watchOS 8, macOS Big Sur 11.6. An application may be able to access restricted files.

Weakness: CWE-59

Which versions are affected by CVE-2021-30855?

It affects 6 products.

Products include Apple Ipados, Apple Iphone Os, Apple Mac Os X, Apple Macos, Apple Tvos, Apple Watchos.

How do I fix CVE-2021-30855?

No fix has been published for CVE-2021-30855 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-30855 being exploited?

There is no known exploitation of CVE-2021-30855 in the wild and no public exploit code.

Other vulnerabilities in Apple Ipados

• CVE-2025-43300 Apple iOS, iPadOS, and macOS Out-of-Bounds Write Exploited Critical 10.0
• CVE-2025-24201 Apple Multiple Products WebKit Out-of-Bounds Write Exploited Critical 10.0
• CVE-2025-24085 Apple Multiple Products Use-After-Free Exploited Critical 10.0
• CVE-2025-31200 Apple Multiple Products Memory Corruption Exploited Critical 9.8
• CVE-2025-31201 Apple Multiple Products Arbitrary Read and Write Exploited Critical 9.8

All Apple Ipados vulnerabilities

Sources

• CVE record
• NVD
• OSV
• How this page is made