CVE-2026-13723

A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing: • a symlink entry named ss pointing to a target file, and • a regular file named ß containing attacker controlled data, will cause the second write to follow the symlink and overwrite the target file.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
http://kb.cert.org/vuls/id/293714
https://github.com/develar/app-builder
https://github.com/develar/app-builder/pull/163
https://www.kb.cert.org/vuls/id/293714

Configurations

No configuration.

History

29 Jul 2026, 19:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5
CWE		CWE-22 CWE-59
References		() https://www.kb.cert.org/vuls/id/293714 -

29 Jul 2026, 18:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-29 18:16

Updated : 2026-07-30 19:10

NVD link : CVE-2026-13723

Mitre link : CVE-2026-13723

CVE.ORG link : CVE-2026-13723

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2026-13723", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13723", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T18:21:31.256338Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "Develar", "product": "app-builder", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "4.2.0"}]}]}], "published": "2026-07-29T18:16:50.603", "references": [{"url": "http://kb.cert.org/vuls/id/293714", "source": "cret@cert.org"}, {"url": "https://github.com/develar/app-builder", "source": "cret@cert.org"}, {"url": "https://github.com/develar/app-builder/pull/163", "source": "cret@cert.org"}, {"url": "https://www.kb.cert.org/vuls/id/293714", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., \u00df \u2194 ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing:\r\n\u2022\ta symlink entry named ss pointing to a target file, and\r\n\u2022\ta regular file named \u00df containing attacker controlled data,\r\nwill cause the second write to follow the symlink and overwrite the target file."}], "lastModified": "2026-07-30T19:10:06.847", "sourceIdentifier": "cret@cert.org"}