Sparkle versions before 2.9.2 contain a path traversal vulnerability (CWE-22) in the delta update extraction process. The code checks for '..' in relative paths and rejects writes if the immediate parent directory is a symlink, but it fails to detect symlinks deeper in the path. The extractItem: function creates symlinks from archive content without validating the symlink target, enabling escape from the intended destination directory during file writes. Exploitation requires a malicious .delta file that passes EdDSA signature verification, implying compromise of the signing private key. When the AppInstaller runs as root for system-domain installs, this allows arbitrary root-level file writes beyond normal bundle replacement. The issue is patched in Sparkle version 2.9.2.

An attacker with access to the EdDSA private signing key can craft a malicious update (.delta) that exploits this vulnerability to write arbitrary files at the root level on macOS systems where Sparkle is used for system-domain installs. This elevates the attacker's capabilities beyond normal update replacement, potentially enabling full system compromise. There is no indication of known exploits in the wild.

Upgrade to Sparkle version 2.9.2 or later, which contains a patch for this path traversal vulnerability. Since the vulnerability requires a compromised EdDSA signing key to exploit, protecting the signing keys is critical. No other mitigations are indicated.