Apple Private Cloud Compute Path Traversal Flaw Lets Attackers Write Files as Root

Security researcher Drinor Selmanaj has disclosed a path traversal vulnerability (CVE-2026-20685) in Apple’s Private Cloud Compute (PCC) that allows a privileged network attacker to write attacker-controlled files as root during node boot.

This flaw affects the Apple Intelligence cloud-inference infrastructure. Apple has addressed the issue in PCC Release 5E290.3 and later, rating it as an information disclosure vulnerability with a CVSS score of 6.5.

Apple Private Cloud Compute Path Traversal Flaw

PCC is designed to extend device-level privacy protections to cloud inference. Its model incorporates stateless processing, cryptographic software attestation, and controlled telemetry exports. This finding is critical because it targets provisioning before the hardened runtime is initiated.

The vulnerable component, darwin-init, runs as root and is the first userspace process that executes on a booting PCC node. It retrieves configurations, downloads system cryptexes, extracts and installs them, and then triggers a userspace reboot into operation. During this window, it can write to the persistent data volume before steady-state safeguards are activated.

According to research by Sentry, darwin-init used an extraction routine that considered only the first 4 bytes of an artifact. Archives that did not match Apple-specific signatures followed a generic libarchive extraction path.

This routine appends archive entry names to an output directory without validating or normalizing them, allowing directory traversal sequences to escape the intended extraction location.

The researcher demonstrated that a crafted archive could place files in /var/db, a persistent, writable location, while still containing a structurally valid cryptex bundle.

The valid bundle passed installation checks, allowing the reboot to complete successfully. In the research environment, the payload survived the reboot, confirming that darwin-init had written a file outside of its designated directory with root privileges.

The proof of concept also highlighted a confidentiality impact. By writing a configuration file used by PCC’s internal splunkloggingd telemetry forwarder, the researcher redirected selected logs to a controlled endpoint.

The captured data included telemetry and request metadata; inference tests revealed token counts, timing information, and workload identifiers. Such metadata can expose characteristics of AI requests, even if the prompt content is not directly disclosed.

A notable outcome was the discovery of an apparent attestation blind spot. The researcher found that both compromised and clean boot images produced identical results in assessed software-attestation fields, while differences in the writable data volume were not measured.

This suggests that PCC attestation verifies installed software but does not necessarily attest to every runtime configuration file that could influence service behavior.

Apple mitigated the path-handling weakness by enhancing validation. PCC operators should deploy Release 5E290.3 or newer, restrict access to provisioning and adjacent network paths, and review telemetry-forwarder configurations for unauthorized changes.

Researchers should also regard boot-time extractors, persistent data volumes, and non-code configurations as critical components of confidential computing trust boundaries.

Selmanaj conducted the research in Apple’s Virtual Research Environment in accordance with responsible disclosure rules. Apple recognized the report through its Security Bounty program and awarded Selmanaj $150,000.

The research did not target production systems. This case emphasizes that AI security extends beyond model behavior; well-known archive-extraction vulnerabilities can undermine inference infrastructure and privacy controls.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world