Translated with AI from the Russian original.
It allowed reading, downloading, and deleting files from users' cloud storage.
An expert from the Positive Technologies team, Egor Filatov, identified and helped eliminate a vulnerability in the Yandex Disk cloud service for devices running macOS. In the event of a successful attack, an attacker could gain access to a corporate account and user data. The vendor promptly released a software update after being notified of the threat under the responsible disclosure policy.
According to Positive Technologies' threat monitoring, more than 50,000 devices worldwide were potentially vulnerable, most of which are located in Russia (91%), as well as in Germany (3%), Belarus and Kazakhstan (2% each). The software update eliminates this threat and increases the level of user protection. The company emphasized that macOS users need to update Yandex Disk to version 3.2.45.3275. Positive Technologies reported:
Vulnerability PT-2025-447371 (CVE-2025-5470, BDU: 2025-08831) received 7.3 points out of 10 on the CVSS 4.0 scale, which corresponds to a high level of threat. The found error was contained in Yandex Disk version 3.2.44 for Apple computers and laptops. By exploiting it, an attacker could read, download, and delete files from users' cloud storage. The attacker could use the information obtained for phishing attacks.
