CVE-2025-61229
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in Shirt Pocket SuperDuper! 3.10 and earlier allows a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thereby bypassing macOS privacy controls.
Risk Assessment
An attacker can gain unauthorized access to sensitive system and user data, as well as escalate privileges to root, potentially leading to full system compromise.
Recommendation
Immediately update SuperDuper! to the latest available version that fixes this vulnerability, and restrict local system access to trusted users only.
Other vulnerabilities in SuperDuper!
See all- CVE-2025-69604High
A vulnerability in SuperDuper! 3.11 and earlier allows a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thereby bypassing macOS privacy controls.
- CVE-2025-61228High
A vulnerability in Shirt Pocket SuperDuper! version 3.10 and earlier allows a local attacker to execute arbitrary code via the software update mechanism.
Original NVD description (English source)
An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thus bypassing macOS privacy controls.