PT-2025-48487 · Shirt Pocket · Superduper!

Published 2025-12-01 · Updated 2025-12-01 · CVE-2025-61229

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SuperDuper! versions 3.10 and earlier

Description An issue in SuperDuper! versions 3.10 and earlier allows a local attacker to modify the default task template. This modification enables the execution of an arbitrary preflight script with root privileges and Full Disk Access, bypassing macOS privacy controls.

Recommendations Update to a version later than 3.10.

Fix

LPE

Improper Access Control

Incorrect Default Permissions

Weakness Enumeration

CWE-284

CWE-276

Related Identifiers

CVE-2025-61229

Affected Products

Superduper!

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-61229 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61229 · Vendor Advisory
• https://shirtpocket.com/blog/index.php/shadedgrey/comments/superduper_security_update_v311 · Note
• https://twitter.com/CVEnew/status/1995529061444018300 · Twitter Post
• http://shirt.com · Note
• https://shirt-pocket.com/SuperDuper/SuperDuperDescription.html · Note
• https://t.me/CVEtracker/38550 · Telegram Post