CVE-2025-61229
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-01

Last updated on: 2025-12-08

Assigner: MITRE

Description
An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thus bypassing macOS privacy controls.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-01
Last Modified
2025-12-08
Generated
2026-06-16
AI Q&A
2025-12-01
EPSS Evaluated
2026-06-15
NVD
CVE-2025-61229
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
shirt-pocket superduper\! to 3.10 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-276 During installation, installed file permissions are set to allow anyone to modify those files.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Shirt Pocket's SuperDuper! version 3.10 and earlier allows a local attacker to modify the default task template. By doing so, the attacker can execute an arbitrary preflight script with root privileges and Full Disk Access, effectively bypassing macOS privacy controls.

Impact Analysis

The vulnerability can allow a local attacker to gain root-level access and full disk access on a macOS system running SuperDuper! 3.10 or earlier. This could lead to unauthorized execution of code with elevated privileges, potentially compromising the entire system and sensitive data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-61229. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart