sparkle-project Sparkle up to 2.9.1 Autoupdate SPUSparkleDeltaArchive.m extractItem path traversal

Summaryinfo

A vulnerability, which was classified as very critical, was found in sparkle-project Sparkle up to 2.9.1. This vulnerability affects the function extractItem of the file Autoupdate/SUBinaryDeltaApply.m/Autoupdate/SPUSparkleDeltaArchive.m of the component Autoupdate/SUBinaryDeltaApply/SPUSparkleDeltaArchive. Such manipulation leads to path traversal. This vulnerability is referenced as CVE-2026-47121. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in sparkle-project Sparkle up to 2.9.1. Affected by this issue is the function extractItem of the file Autoupdate/SUBinaryDeltaApply.m/Autoupdate/SPUSparkleDeltaArchive.m of the component Autoupdate/SUBinaryDeltaApply/SPUSparkleDeltaArchive. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@".."` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative path. `Autoupdate/SPUSparkleDeltaArchive.m`'s `extractItem:` will create symlinks in the destination tree from archive content (no `..` check on the symlink target), and a subsequent `Extract` item targeting `<symlink>/foo/bar` then escapes the destination tree via `fopen(path, "wb")` because the kernel resolves the intermediate symlink during the open call. This is a defense-in-depth issue: exploitation requires a maliciously-crafted `.delta` that passes EdDSA signature verification, i.e. EdDSA private-key compromise. With the AppInstaller running as root for system-domain installs, it gives the holder of a stolen signing key arbitrary file write at root level via the delta-apply path, which is a strictly broader primitive than the "drop-in replacement bundle" install they would otherwise have. Version 2.9.2 contains a patch for the issue.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-47121 since 05/18/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/21/2026). The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 2.9.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• sparkle-project

Name

• Sparkle

Version

• 2.9.0
• 2.9.1

Website

• Product: https://github.com/sparkle-project/Sparkle/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion