EUVD-2025-16718
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4Description
A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation.
Analysis
Directory traversal vulnerability in Parallels Desktop for Mac version 20.2.2 (build 55879) affecting the PVMP package unpacking functionality. An authenticated local attacker with limited privileges can exploit this flaw to write arbitrary files to the system, potentially achieving privilege escalation with high impact on confidentiality, integrity, and availability. The vulnerability requires local access and user interaction is not needed, making it a significant risk for multi-user or shared Mac environments.
Technical Context
The vulnerability exists in the PVMP (Parallels Virtual Machine Package) unpacking mechanism used by Parallels Desktop for Mac. PVMP files are container formats for virtual machine configurations and data. The directory traversal flaw (CWE-22) occurs when the unpacking routine fails to properly validate and sanitize file paths extracted from PVMP archives before writing them to disk. This allows path traversal sequences (e.g., '../../../') to escape intended directories and write files to arbitrary locations on the filesystem. The affected product is CPE:2.3:a:parallels:desktop:20.2.2:*:*:mac:*:*:*:*. This is a path validation issue in archive extraction logic, a well-known attack vector when input sanitization is insufficient.
Affected Products
Parallels Desktop for Mac (20.2.2 (build 55879))
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today