CVE-2025-69604: High severity Shirt Pocket SuperDuper! vulnerability
Published Jan 29, 2026
·Updated
An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls.
Affected Software
2 affected components
Shirt Pocket SuperDuper!<3.11
Shirt-pocket Superduper\!<3.12
Event History
Jan 29, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-69604?
The severity of CVE-2025-69604 is high, with a CVSS score of 7.8.
2
What type of vulnerability is CVE-2025-69604?
CVE-2025-69604 is a local privilege escalation vulnerability in Shirt Pocket's SuperDuper! software.
3
How do I fix CVE-2025-69604?
To fix CVE-2025-69604, update Shirt Pocket's SuperDuper! to version 3.12 or later.
4
What are the risks associated with CVE-2025-69604?
CVTE-2025-69604 allows a local attacker to modify task templates, potentially running harmful scripts with root privileges.
5
When was CVE-2025-69604 published?
CVE-2025-69604 was published on January 29, 2026.