Stored HTML Injection Vulnerability in Time Machine by Apple

CVE-2025-40891

What is CVE-2025-40891?

A vulnerability exists in Apple Time Machine that allows an unauthenticated attacker to exploit the Snapshot Diff functionality. This exploitation arises from improper validation of incoming network traffic data, enabling the injection of HTML tags into attributes of assets across different snapshots. To exploit this vulnerability, a user must access the Time Machine Snapshot Diff feature and execute specific graphical user interface actions. The result is that the injected HTML executes in their browser, potentially leading to phishing and open redirect incidents. While effective input validation and a Content Security Policy are in place to mitigate risks, the complex nature of the attack, necessitating multiple conditions, raises concerns about user security.

References