CVE-2025-10016

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege escalation to root privileges. It is worth noting that it is possible to spawn Autopudate manually via Installer XPC service. However this requires the victim to enter credentials upon system authorization dialog creation that can be modified by the attacker. This issue was fixed in version 2.7.2

• CWE-863

• https://cert.pl/en/posts/2025/09/CVE-2025-10015
• https://github.com/sparkle-project/Sparkle
• https://github.com/sparkle-project/Sparkle/discussions/2764

Published

Sep 16, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-10010The CPSD CryptoPro Secure Disk application boots a small Lin…6.8
• CVE-2025-10011A weakness has been identified in Portabilis i-Educar up to …8.8
• CVE-2025-10012A security vulnerability has been detected in Portabilis i-E…8.8
• CVE-2025-10013A vulnerability was detected in Portabilis i-Educar up to 2.…6.3
• CVE-2025-10014A flaw has been found in elunez eladmin up to 2.7. This impa…3.1
• CVE-2025-10015The Sparkle framework includes an XPC service Downloader.xpc…4.8
• CVE-2025-10018QuickCMS is vulnerable to multiple Stored XSS in language ed…4.8
• CVE-2025-10019Authorization Bypass Through User-Controlled Key vulnerabili…6.5
• CVE-2025-1002MicroDicom DICOM Viewer version 2024.03 fails to adequately…5.3
• CVE-2025-10020Zohocorp ManageEngine ADManager Plus version before 8024 are…8.8
• CVE-2025-10021A Use of Uninitialized Variable vulnerability exists in Open…7
• CVE-2025-10023Improper Neutralization of Input During Web Page Generation …4.8