CVE-2026-13723

{
  "id": "CVE-2026-13723",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-29T18:16:50.603",
  "lastModified": "2026-10-24T13:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing:\r\n•\ta symlink entry named ss pointing to a target file, and\r\n•\ta regular file named ß containing attacker controlled data,\r\nwill cause the second write to follow the symlink and overwrite the target file."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la rutina de extracción “zipx.Unzip” del creador de aplicaciones de Develar permite a un atacante sobrescribir archivos arbitrarios en macOS APFS explotando una Colisión de Normalización Unicode combinada con el comportamiento de seguimiento de enlaces simbólicos. APFS trata ciertos nombres de archivo equivalentes en Unicode como idénticos (p. ej., ß ? ss), mientras que el creador de aplicaciones no realiza ninguna normalización canónica antes de validar o escribir rutas. Como resultado, un archivo ZIP manipulado que contenga:\n•\tuna entrada de enlace simbólico llamada ss que apunta a un archivo objetivo, y\n•\tun archivo regular llamado ß que contiene datos controlados por el atacante,\nhará que la segunda escritura siga el enlace simbólico y sobrescriba el archivo objetivo."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Develar",
          "product": "app-builder",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "4.2.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-29T18:21:31.256338Z",
          "id": "CVE-2026-13723",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://kb.cert.org/vuls/id/293714",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/develar/app-builder",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/develar/app-builder/pull/163",
      "source": "[email protected]"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/293714",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}