BaseFortify

Publication date: 2025-12-01

Last updated on: 2026-07-05

Assigner: MITRE

Description

An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thus bypassing macOS privacy controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-01

Last Modified

2026-07-05

Generated

2026-07-06

AI Q&A

2025-12-01

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61229

Affected Vendors & Products

Vendor	Product	Version / Range
shirt-pocket	superduper\!	to 3.10 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-276	During installation, installed file permissions are set to allow anyone to modify those files.

Attack-Flow Graph

Executive Summary

This vulnerability in Shirt Pocket's SuperDuper! version 3.10 and earlier allows a local attacker to modify the default task template. By doing so, the attacker can execute an arbitrary preflight script with root privileges and Full Disk Access, effectively bypassing macOS privacy controls.

Impact Analysis

The vulnerability can allow a local attacker to gain root-level access and full disk access on a macOS system running SuperDuper! 3.10 or earlier. This could lead to unauthorized execution of code with elevated privileges, potentially compromising the entire system and sensitive data.

Hi! I’m here to help you understand CVE-2025-61229. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70