CVE-2025-43537: iOS/iPadOS Path Traversal Vulnerability

CVE-2025-43537 Overview

CVE-2025-43537 is a path handling vulnerability affecting Apple iOS and iPadOS devices. The vulnerability stems from improper validation of file paths during the backup restoration process. When a user restores a maliciously crafted backup file, an attacker could potentially modify protected system files, compromising the integrity of the device's operating system.

Critical Impact

Restoring a maliciously crafted backup file may lead to modification of protected system files, potentially allowing attackers to alter critical iOS/iPadOS components.

Affected Products

• iOS versions prior to 18.7.5
• iPadOS versions prior to 18.7.5

Discovery Timeline

• 2026-02-11 - CVE-2025-43537 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2025-43537

Vulnerability Analysis

This vulnerability exists within the backup restoration mechanism of iOS and iPadOS. The core issue lies in how the operating system validates file paths contained within backup archives during the restore process. When processing backup files, the system fails to properly validate path components, allowing malicious path constructs to escape intended directory boundaries.

An attacker who can create or modify a backup file could craft malicious path entries that, when restored, would write files to protected system locations rather than the intended user data directories. This type of vulnerability is commonly exploited using directory traversal techniques where path components like ../ are used to navigate outside of expected directories.

The impact of successful exploitation includes the ability to overwrite critical system files, potentially leading to persistent compromise of the device, privilege escalation, or installation of malicious components that survive device restores.

Root Cause

The root cause of this vulnerability is insufficient path validation in the backup restoration code. The system did not adequately sanitize or validate file paths extracted from backup archives before writing files to the file system. This allowed specially crafted path strings to reference locations outside the intended restoration directory, bypassing the protection mechanisms that normally prevent modification of system files.

Attack Vector

Exploitation of this vulnerability requires an attacker to deliver a maliciously crafted backup file to the victim. Potential attack scenarios include:

1. Social Engineering: Convincing a user to restore from a backup file provided by the attacker, perhaps disguised as a legitimate backup from a compromised cloud service or shared storage.

2. Compromised Backup Infrastructure: If an attacker gains access to backup storage (such as a compromised iCloud account or local backup server), they could modify existing backups to include malicious path entries.

3. Man-in-the-Middle: In scenarios where backups are transferred over a network, an attacker with network access could potentially intercept and modify backup data in transit.

The attack requires user interaction to initiate the restore process, but once triggered, the file system modifications occur without additional user consent or notification.

Detection Methods for CVE-2025-43537

Indicators of Compromise

• Unexpected modifications to system files with timestamps correlating to backup restoration events
• Presence of files in protected system directories that were not part of legitimate iOS/iPadOS installations
• System instability or unexpected behavior following a backup restoration
• Anomalous file system activity during or immediately after restore operations

Detection Strategies

• Monitor file system integrity of protected system directories before and after backup restorations
• Implement endpoint detection to identify unusual file write operations to system-protected paths
• Review restore logs for path anomalies or traversal patterns (e.g., sequences containing ../)
• Deploy mobile device management (MDM) solutions that can audit device state and detect unauthorized modifications

Monitoring Recommendations

• Enable comprehensive logging for backup and restore operations on managed iOS/iPadOS devices
• Implement automated alerts for file system modifications in protected directories
• Regularly audit device integrity using MDM or mobile threat defense solutions
• Monitor for indicators of backup file tampering in cloud storage or backup repositories

How to Mitigate CVE-2025-43537

Immediate Actions Required

• Update all iOS devices to version 18.7.5 or later immediately
• Update all iPadOS devices to version 18.7.5 or later immediately
• Avoid restoring from backup files of unknown or untrusted origin
• Verify the integrity and source of any backup files before restoration
• Review recent backup restorations on vulnerable devices for signs of compromise

Patch Information

Apple has addressed this vulnerability in iOS 18.7.5 and iPadOS 18.7.5 by implementing improved validation for path handling during the backup restoration process. Organizations and users should apply this update as soon as possible. For detailed patch information, refer to the Apple Security Advisory 126347.

Workarounds

• Only restore from trusted backup sources until patching is complete
• Use MDM solutions to restrict backup restoration capabilities on managed devices
• Implement network controls to prevent unauthorized backup file distribution
• Consider factory resetting and manually reconfiguring devices rather than restoring from potentially compromised backups
• Maintain backup files in secure, access-controlled storage with integrity monitoring

Organizations using SentinelOne can leverage the Singularity Mobile platform to detect and respond to threats targeting iOS and iPadOS devices, including monitoring for indicators of compromise associated with this vulnerability.