CVE-2026-47121 in Sparkle
Summary
by MITRE • 07/21/2026
Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@".."` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative path. `Autoupdate/SPUSparkleDeltaArchive.m`'s `extractItem:` will create symlinks in the destination tree from archive content (no `..` check on the symlink target), and a subsequent `Extract` item targeting `<symlink>/foo/bar` then escapes the destination tree via `fopen(path, "wb")` because the kernel resolves the intermediate symlink during the open call. This is a defense-in-depth issue: exploitation requires a maliciously-crafted `.delta` that passes EdDSA signature verification, i.e. EdDSA private-key compromise. With the AppInstaller running as root for system-domain installs, it gives the holder of a stolen signing key arbitrary file write at root level via the delta-apply path, which is a strictly broader primitive than the "drop-in replacement bundle" install they would otherwise have. Version 2.9.2 contains a patch for the issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in Sparkle update framework affects versions prior to 2.9.2 and represents a sophisticated path traversal issue within the delta update mechanism. The flaw exists in the `Autoupdate/SUBinaryDeltaApply.m` file where the system performs a basic check using `relativePath.pathComponents containsObject:@".."` to prevent directory traversal attacks. However, this protection is insufficient as it only examines the immediate parent directory for symbolic link references but fails to detect deeper symbolic links within the relative path structure. This creates a critical gap in the security model where maliciously crafted paths can bypass the initial validation checks.
The vulnerability manifests through the interaction between two components in the update process: `Autoupdate/SPUSparkleDeltaArchive.m` and the subsequent extraction logic. The archive extraction method `extractItem:` processes symlink targets from the archive content without performing the same `..` validation that protects against directory traversal. When a malicious delta file contains symlinks pointing to locations outside the intended destination tree, these symlinks can be created during the archive extraction phase. Subsequent extraction operations targeting paths like `<symlink>/foo/bar` then exploit the kernel's automatic symlink resolution behavior during `fopen(path, "wb")` calls, effectively allowing attackers to write files anywhere in the filesystem regardless of the intended destination tree boundaries.
This vulnerability represents a classic defense-in-depth failure where multiple security controls are bypassed through a carefully crafted attack chain. The issue is particularly dangerous because it requires an attacker to possess the EdDSA private key used for signing updates, which would typically be compromised through sophisticated attacks or supply chain compromises. However, even with this requirement, the impact remains severe as the system executes update operations with root privileges during system-domain installations through AppInstaller. The attack vector provides arbitrary file write capabilities at the root level, creating a much broader primitive than typical "drop-in replacement bundle" attacks that would otherwise be possible with compromised signing keys.
The security implications extend beyond simple file system access violations and represent a serious privilege escalation vulnerability within macOS update frameworks. This issue directly relates to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-36 (Absolute Path Traversal) while also mapping to ATT&CK technique T1059.001 (Command and Scripting Interpreter: PowerShell) through potential exploitation pathways that could leverage the arbitrary write capabilities for persistence or further attack execution. The vulnerability demonstrates how seemingly minor validation checks can create catastrophic security implications when combined with legitimate system functionality, particularly in update frameworks that operate with elevated privileges.
The patch implemented in version 2.9.2 addresses this issue by strengthening the path validation logic to detect symbolic links at all levels of the relative path rather than just checking immediate parent directories. This comprehensive fix ensures that any attempt to create symlinks or access paths through symbolic links will be properly validated against the intended destination tree boundaries, preventing the kernel-level symlink resolution from being exploited for arbitrary file operations. The mitigation fundamentally changes how Sparkle handles path validation during delta update processing, requiring all path components to be checked for potential traversal attacks rather than relying on superficial directory component analysis that could be easily bypassed through symbolic link manipulation.