CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta
A path traversal in Sparkle allows arbitrary file writes if a signing key is compromised, enabling root-level code execution during updates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-47121?
CVE-2026-47121 is a medium-severity path traversal vulnerability in sparkle-project Sparkle, published on 21 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@".."` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative path. `Autoupdate/SPUSparkleDeltaArchive.m`'s `extractItem:` will create symlinks in the destination tree from archive content (no `..` check on the symlink target), and a subsequent `Extract` item targeting `<symlink>/foo/bar` then escapes the destination tree via `fopen(path, "wb")` because the kernel resolves the intermediate symlink during the open call. This is a defense-in-depth issue: exploitation requires a maliciously-crafted `.delta` that passes EdDSA signature verification, i.e. EdDSA private-key compromise. With the AppInstaller running as root for system-domain installs, it gives the holder of a stolen signing key arbitrary file write at root level via the delta-apply path, which is a strictly broader primitive than the "drop-in replacement bundle" install they would otherwise have. Version 2.9.2 contains a patch for the issue.
Which versions are affected by CVE-2026-47121?
2 open source packages ship an affected version, including github.com/sparkle-project/Sparkle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/sparkle-project/Sparkle SwiftURL | All versions | 2.9.2 |
github.com/sparkle-project/Sparkle SwiftURL | All versions | 2.9.2 |
Products include Sparkle-Project Sparkle.
How do I fix CVE-2026-47121?
Upgrade github.com/sparkle-project/Sparkle to 2.9.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-47121 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47121 exists.
Other vulnerabilities in sparkle-project Sparkle
Sources
Also known as GHSA-hg88-v3cw-3qrh.