High severity · published Jun 3, 2025
CVE-2025-31359
A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879)
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PD
Parallels Desktop for Mac · Parallels
20.2.2 (55879) · source: vendor
PD
Parallels Desktop · Parallels
20.2.2_(55879) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-31359
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-31359
Exploit
https://talosintelligence.com/vulnerability_reports/TALOS-2025-2160
Exploit
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2160
More from Parallels Desktop for Mac
7.8
CVE-2026-90894
Parallels Desktop local privilege escalation via appliance extract argument injection
7.8
CVE-2024-52561
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740)
7.8
CVE-2024-54189
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740)
7.8
CVE-2024-36486
A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740)