7.8

CVE-2025-69604

EPSS 0.1%
Veröffentlicht 29.01.2026 00:00:00
Zuletzt bearbeitet 13.02.2026 20:32:40
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 6

NVD 1 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Shirt-pocket ≫ Superduper! Version < 3.12

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.1%	0.011

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

http://shirt.com

Broken Link

https://shirt-pocket.com/SuperDuper/SuperDuperDescription.html

Product

https://www.shirtpocket.com/blog/index.php/shadedgrey/comments/superduper_v312_now_available

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2025-69604

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-69604

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-69604

EUVD