Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Sparkle update can write files outside app folder

CVE-2026-47121 · published 3 months ago
Summary

The Sparkle update system for macOS before version 2.9.2 can be tricked into placing files outside the intended application directory when processing a specially crafted update file. If an attacker also has access to the signing key, they could write files anywhere on the machine, including system locations. Upgrade to Sparkle 2.9.2 or later to fix the issue.

What to do
  • Update sparkle-project sparkle to version 2.9.2 or later.
Affected software
Ecosystem VendorProductAffected versions
swift github.com sparkle-project <= 2.9.1
– sparkle-project sparkle < 2.9.2
Original advisory text
Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta
Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@".."` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative path. `Autoupdate/SPUSparkleDeltaArchive.m`'s `extractItem:` will create symlinks in the destination tree from archive content (no `..` check on the symlink target), and a subsequent `Extract` item targeting `<symlink>/foo/bar` then escapes the destination tree via `fopen(path, "wb")` because the kernel resolves the intermediate symlink during the open call. This is a defense-in-depth issue: exploitation requires a maliciously-crafted `.delta` that passes EdDSA signature verification, i.e. EdDSA private-key compromise. With the AppInstaller running as root for system-domain installs, it gives the holder of a stolen signing key arbitrary file write at root level via the delta-apply path, which is a strictly broader primitive than the "drop-in replacement bundle" install they would otherwise have. Version 2.9.2 contains a patch for the issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
CWE-59Link Following
Timeline
Published21 Jul 2026
Updated4 Nov 2026
First seen29 May 2026
Sources
GHSA-hg88-v3cw-3qrh · GHSA
CVE-2026-47121 · NVD
CVE-2026-47121 · MITRE
CVE-2026-47121 · OSV
Track software like this
Free during beta