CVE-2026-13723
Severity CVSS v4.0:
Pending analysis
Type:
CWE-22
Path Traversal
Publication date:
29/07/2026
Last modified:
30/07/2026
Description
A vulnerability in the `zipx.Unzip` extraction routine of Develar&#39;s app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing:<br />
• a symlink entry named ss pointing to a target file, and<br />
• a regular file named ß containing attacker controlled data,<br />
will cause the second write to follow the symlink and overwrite the target file.
Impact
Base Score 3.x
6.50
Severity 3.x
MEDIUM