Vulnerability · Published Jun 3, 2025 · Assigned by talos
CVE-2025-31359
High 8.8
In plain English
A high-severity path traversal in Parallels Desktop for Mac from Parallels. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 55.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Parallels | Parallels Desktop for Mac | 20.2.2 (55879) |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H