{"id":"CVE-2026-86877","kind":"vulnerability","aliases":["CVE-2026-86877"],"related":[],"title":"macOS: path traversal lets a malicious app delete protected files","description":"A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27. A malicious app may be able to delete files for which it does not have privileges.","summary":"A path traversal flaw in macOS Golden Gate 27 lets a malicious app delete files it has no privileges to remove. The fix is improved path validation in the operating system.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","developer-laptops","infrastructure","macos"],"not_affected_if":["non-macos-systems"],"how_to_check":"- Check the installed macOS version under Apple menu > About This Mac, or run `sw_vers -productVersion` in Terminal.\n- Compare the result against the first fixed build listed by Apple for Golden Gate 27; the sources do not give a version number.","fix":"- Install the macOS Golden Gate 27 update that Apple lists as fixing this issue (version unknown from the sources).","status":"open","published_at":"2026-10-26T21:20:22+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","triaged_at":"2026-10-26T21:57:02+00:00","updated_at":"2026-10-26T21:57:02+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:57:02Z","model":"claude-haiku-5-5","output":{"fix":"- Install the macOS Golden Gate 27 update that Apple lists as fixing this issue (version unknown from the sources).","reach":"local","title":"macOS: path traversal lets a malicious app delete protected files","impact":"medium","summary":"A path traversal flaw in macOS Golden Gate 27 lets a malicious app delete files it has no privileges to remove. The fix is improved path validation in the operating system.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple","developer-laptops"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A malicious local app deletes files outside its permissions.","analyst_note":"Find Apple's security notes for macOS Golden Gate 27 to confirm the fixed build and which earlier versions are affected.","how_to_check":"- Check the installed macOS version under Apple menu > About This Mac, or run `sw_vers -productVersion` in Terminal.\n- Compare the result against the first fixed build listed by Apple for Golden Gate 27; the sources do not give a version number.","needs_analyst":true,"not_affected_if":["non-macos-systems"],"who_is_affected":"Teams running macOS Golden Gate 27 on developer laptops or Macs used in build and CI pipelines are affected until they update. The sources do not say which earlier releases are impacted, and they do not describe a server-side or hosted component. Teams using only Linux or Windows machines can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000595,"input_tokens":3249,"output_tokens":540,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-86877':13A,16A '27':31B,72C 'abl':78C 'address':59C 'app':7A,35B,75C 'appl':17B 'cve':11A,14A 'delet':8A,36B,80C 'develop':19B 'developer-laptop':18B 'file':10A,37B,81C 'fix':45B,67C 'flaw':26B 'gate':30B,71C 'golden':29B,70C 'improv':47B,61C 'infrastructur':21B 'issu':57C,65C 'laptop':20B 'let':4A,32B 'maco':1A,22B,28B,69C 'malici':6A,34B,74C 'may':76C 'oper':52B 'path':2A,24B,48B,55C,62C 'privileg':41B,88C 'protect':9A 'remov':43B 'system':53B 'travers':3A,25B,56C 'valid':49B,63C","nicknames":[],"mitigations":[],"who_affected":"Teams running macOS Golden Gate 27 on developer laptops or Macs used in build and CI pipelines are affected until they update. The sources do not say which earlier releases are impacted, and they do not describe a server-side or hosted component. Teams using only Linux or Windows machines can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:20:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86877","severity":null,"published_at":"2026-10-26T21:20:22+00:00","modified_at":"2026-10-26T21:20:22+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","fetched_at":"2026-10-26T21:55:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}