PT-2026-45019 · Sparkle+2 · Sparkle+1
CVE-2026-47121
·
Published
2026-05-29
·
Updated
2026-07-21
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Sparkle versions prior to 2.9.2
Description
A traversal issue exists in the binary delta apply process where the software fails to detect symbolic links deeper than the immediate parent directory in a relative path. An attacker with a compromised EdDSA private signing key can craft a malicious
.delta archive containing a symbolic link that points outside the destination tree. A subsequent extraction item targeting a path through this symbolic link allows the attacker to escape the destination directory via the fopen() function, as the kernel resolves intermediate symbolic links during the open call. When the AppInstaller runs with root privileges for system-domain installations, this allows arbitrary file write at the root level. This is a defense-in-depth issue requiring a stolen signing key to bypass signature verification.Recommendations
Update to version 2.9.2.
As a temporary mitigation, restrict the use of the
extractItem: function or avoid processing .delta archives from untrusted or potentially compromised signing keys.Exploit
Fix
Link Following
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sparkle
Github.Com/Sparkle-Project/Sparkle