CVE-2026-13723
Gravedad CVSS v3.1:
MEDIA
Tipo:
CWE-22
Limitación incorrecta de nombre de ruta a un directorio restringido (Path Traversal)
Fecha de publicación:
29/07/2026
Última modificación:
30/07/2026
Descripción
*** Pendiente de traducción *** A vulnerability in the `zipx.Unzip` extraction routine of Develar&#39;s app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing:<br />
• a symlink entry named ss pointing to a target file, and<br />
• a regular file named ß containing attacker controlled data,<br />
will cause the second write to follow the symlink and overwrite the target file.
Impacto
Puntuación base 3.x
6.50
Gravedad 3.x
MEDIA