Summary of CVE-2025-4280
CVE ID: CVE-2025-4280
Publication Date: May 22, 2025
Vendor: Poetit
Product: Poedit
Vulnerable Versions: 2.0 to 3.6.3
Vulnerability Type: Incorrect Default Permissions (CWE-276)
Report Source: CERT Polska
Description
A vulnerability in the Poedit software has been reported to CERT Polska, which has coordinated its public disclosure. The vulnerability identified as CVE-2025-4280 affects the MacOS version of Poedit, specifically due to its inclusion of a Python interpreter. This interpreter inherits user permissions granted through Transparency, Consent, and Control (TCC) by the user for the main application package.
An attacker with local access to the user’s machine can exploit this vulnerability by invoking the Python interpreter to execute arbitrary commands or scripts. This exploitation allows unauthorized access to the user’s files within privacy-protected folders without triggering user prompts for approval. Moreover, accessing resources beyond what the user has allowed through TCC could potentially mislead the user into providing consent for actions that conceal malicious intent.
This security issue was addressed in version 3.6.3 of Poedit, effectively mitigating the risks associated with the vulnerability. The responsible vulnerability report was credited to the team led by Karol Mazurek from Afine.
For more information about the coordinated vulnerability disclosure process managed by CERT Polska, additional resources are available at CERT Polska.