VulnerabilityAnalyzed
CVE-2025-31359
A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879).
HIGH 8.8EPSS 1.10%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.10%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 1.10% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- parallels/parallels desktop
- Source
- talos-cna@cisco.com
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160Exploit, Third Party Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2160Exploit, Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.