CVE-2025-69604
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A vulnerability in SuperDuper! 3.11 and earlier allows a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thereby bypassing macOS privacy controls.
Risk Assessment
The risk is that a local attacker can escalate privileges to root and gain Full Disk Access, enabling data theft, malware installation, or persistent system compromise.
Recommendation
It is recommended to immediately update SuperDuper! to the latest version that fixes this vulnerability and restrict local system access to trusted users only.
Other vulnerabilities in SuperDuper!
See all- CVE-2025-61229High
A vulnerability in Shirt Pocket SuperDuper! 3.10 and earlier allows a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thereby bypassing macOS privacy controls.
- CVE-2025-61228High
A vulnerability in Shirt Pocket SuperDuper! version 3.10 and earlier allows a local attacker to execute arbitrary code via the software update mechanism.
Original NVD description (English source)
An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls.