CVE-2025-69604

HighCVSS 7.8/10Last modified Jul 5, 2026

Description

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Jan 29, 2026
Last modified: Jul 5, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-696066.1Cross-Site Scripting (XSS) vulnerability was discovered in the GSVoIP web panel version 2.0.90. The `msg` parameter in the `/painel/gateways CVE-2025-69619.8A vulnerability, which was classified as critical, has been found in Campcodes Employee Management System 1.0. Affected by this issue is som CVE-2025-696126.5A path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software. The "Download Templ CVE-2025-696149.4Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account ta CVE-2025-696159.1Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction r CVE-2025-696186.5An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro & Healing v11.4.0 allows attackers to overwrite critica CVE-2025-696195.5A path traversal in My Text Editor v1.6.2 allows attackers to cause a Denial of Service (DoS) via writing files to the internal storage.CVE-2025-69629.8A vulnerability, which was classified as critical, was found in Campcodes Employee Management System 1.0. This affects an unknown part of th CVE-2025-696205.0A path traversal in Moo Chan Song v4.5.7 allows attackers to cause a Denial of Service (DoS) via writing files to the internal storage.CVE-2025-696218.1An arbitrary file overwrite vulnerability in the file import process of Comic Book Reader v1.0.95 allows attackers to overwrite critical int CVE-2025-696247.5Nitro PDF Pro before 14.43 for Windows contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert(). Wh CVE-2025-696278.4Nitro PDF Pro for Windows 14.41.1.4 contains a heap use-after-free vulnerability in the implementation of the JavaScript method this.mailDoc