VULNERABILITY INTELLIGENCE

CVE-2025-69604

CVSS score7.8 HIGH
EPSS probability0.11%
CISA KEVNot currently listed
Published2026-01-29
Last modified2026-07-05
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls.

Weakness classification

  • CWE-276: Incorrect Default Permissions

Primary references