# CVE-2025-61229: Shirt Pocket SuperDuper! privilege escalation via task templates

Source: https://junglewise.ai/threats/cve-2025-61229-shirt-pocket-superduper-privilege-escalation-via-task-templates  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-01. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-61229 · Severity: high · CVSS 7.8 · Published 2025-12-01

SuperDuper! is a backup and disk cloning utility for macOS. A security flaw in versions 3.10 and earlier allows a local attacker or malicious software already on the system to modify backup task templates. This could allow the attacker to run unauthorized scripts with administrative (root) privileges and Full Disk Access, effectively bypassing macOS privacy protections and gaining total control over the computer's data.

Technologies: [Shirt-Pocket Superduper\!](https://junglewise.ai/threats/technologies/superduper). Vendors: [Shirt-Pocket](https://junglewise.ai/threats/vendors/shirt-pocket).

## Quick answers

**Is CVE-2025-61229 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61229 being exploited in the wild.

**How severe is CVE-2025-61229?** High severity, with a CVSS score of 7.8, published 1 December 2025.

**Which products and versions are affected?** Shirt-Pocket Superduper\! 3.10 and earlier.

**Is there a fix for CVE-2025-61229?** A patch was published on 2025-11-18: Vendor released version 3.11 to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-61229 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2025-61229?** Check whether you run Shirt-Pocket Superduper\! at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is classified as improper access control (CWE-284) or incorrect default permissions (CWE-276) within the handling of 'Before/After' shell scripts in SuperDuper!. In affected versions, these user-settable scripts are executed with escalated privileges (root) and inherit the application's TCC Full Disk Access permissions. A local attacker or malicious process can modify the settings files associated with a copy task or schedule to point to a malicious script. Because the application does not sufficiently validate the ownership or integrity of these scripts before execution, the attacker's code runs with elevated permissions, bypassing macOS privacy controls. The issue is addressed in version 3.11 by forcing scripts to run with the user's ID and requiring scripts to be owned by the root user.

## Affected products

- Shirt Pocket SuperDuper! 3.10 and earlier

## Timeline

- 2025-11-18: patched: Vendor released version 3.11 to address the issue.
- 2025-12-01: disclosed: CVE published to NVD.

## References

- [https://shirt-pocket.com/SuperDuper/SuperDuperDescription.html](https://shirt-pocket.com/SuperDuper/SuperDuperDescription.html)
- [https://www.shirtpocket.com/blog/index.php/shadedgrey/comments/superduper_security_update_v311/](https://www.shirtpocket.com/blog/index.php/shadedgrey/comments/superduper_security_update_v311/)

## Related threats

- [Shirt Pocket SuperDuper information disclosure](https://junglewise.ai/threats/cve-2026-107067-an-issue-in-shirt-pocket-s-superduper-4-0-9-and-earlier-allow-a)
- [Shirt Pocket SuperDuper! privilege escalation via task templates](https://junglewise.ai/threats/cve-2025-69604-shirt-pocket-superduper-privilege-escalation-via-task-templates)
- [Shirt Pocket SuperDuper! code execution via software update mechanism](https://junglewise.ai/threats/cve-2025-61228-shirt-pocket-superduper-code-execution-via-software-update)
- [Shirt Pocket SuperDuper! privilege escalation in SDAgent](https://junglewise.ai/threats/cve-2025-57489-shirt-pocket-superduper-privilege-escalation-in-sdagent)