PatchTheCVECVE-2025-69604: An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task temp
CVE-2025-69604 is a high-severity flaw (CVSS 7.8) affecting superduper\!. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 98%) |
| CISA exploited list | No |
| Weakness | CWE-276 |
| Published | 2026-01-29 |
| Last modified | 2026-07-05 |
Last updated 2026-07-05 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-69604?
superduper\!: upgrade to 3.12. Exact commands for each OS are on this page.
Is CVE-2025-69604 being exploited?
CVE-2025-69604 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-69604 affect?
CVE-2025-69604 affects superduper\!. Severity is high (CVSS 7.8). An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS pr
How urgent is CVE-2025-69604?
Priority 28/100. High severity