PT-2025-23599 · Parallels · Parallels Desktop For Mac

Kpc Of · Published 2025-06-03 · Updated 2026-06-05 · CVE-2025-31359

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Parallels Desktop for Mac version 20.2.2

Description A directory traversal vulnerability exists in the PVMP package unpacking functionality. This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation.

Recommendations For Parallels Desktop for Mac version 20.2.2, update to a version that fixes this issue, as no specific workaround is provided in the given information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-31359

Affected Products

Parallels Desktop For Mac

References · 9

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-31359 · Security Note
• https://osv.dev/vulnerability/CVE-2025-31359 · Vendor Advisory
• https://t.me/CSIRT_italia/3592 · Telegram Post
• https://t.me/cvenotify/124451 · Telegram Post
• https://twitter.com/CVEnew/status/1929838769785778236 · Twitter Post
• https://t.me/cvenotify/124444 · Telegram Post
• https://twitter.com/CveFindCom/status/1929843105617903716 · Twitter Post
• https://t.me/cvetracker/25262 · Telegram Post