Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-0509

CVE-2025-0509: Sparkle Signing Checks Bypass

7.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2025-0509
GHSA ID
GHSA-wc9m-r3v6-9p5h
EPSS Score
0.01395%
CWE
CWE-552
Published
2/4/2025
Updated
2/4/2025
KEV Status
No
Technology
TechnologySwift

Technical Details

CVSS Vector
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/sparkle-project/Sparkleswift<= 2.6.32.6.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper directory isolation during archive extraction. The GitHub PR #2550 specifically addresses this by separating input/output directories, and the CWE-552 (External File Access) aligns with directory access issues. The commit message explicitly states this fixes an attack vector where input archives could be overwritten. The SUUnarchiver class is central to Sparkle's update processing, making it the logical location for this vulnerability. High confidence comes from direct correlation between the fix in 2.6.4, the CWE mapping, and the advisory description of signature bypass through file replacement.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* s**urity issu* w*s *oun* in Sp*rkl* ***or* v*rsion *.*.*. *n *tt**k*r **n r*pl*** *n *xistin* si*n** up**t* wit* *not**r p*ylo**, *yp*ssin* Sp*rkl*’s (**)*S* si*nin* ****ks.

Reasoning

T** vuln*r**ility st*ms *rom improp*r *ir**tory isol*tion *urin* *r**iv* *xtr**tion. T** *it*u* PR #**** sp**i*i**lly ***r*ss*s t*is *y s*p*r*tin* input/output *ir**tori*s, *n* t** *W*-*** (*xt*rn*l *il* ****ss) *li*ns wit* *ir**tory ****ss issu*s. T