CVE-2026-13723

{"id": "CVE-2026-13723", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13723", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T18:21:31.256338Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "Develar", "product": "app-builder", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "4.2.0"}]}]}], "published": "2026-07-29T18:16:50.603", "references": [{"url": "http://kb.cert.org/vuls/id/293714", "source": "cret@cert.org"}, {"url": "https://github.com/develar/app-builder", "source": "cret@cert.org"}, {"url": "https://github.com/develar/app-builder/pull/163", "source": "cret@cert.org"}, {"url": "https://www.kb.cert.org/vuls/id/293714", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., \u00df \u2194 ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing:\r\n\u2022\ta symlink entry named ss pointing to a target file, and\r\n\u2022\ta regular file named \u00df containing attacker controlled data,\r\nwill cause the second write to follow the symlink and overwrite the target file."}, {"lang": "es", "value": "Una vulnerabilidad en la rutina de extracci\u00f3n \u201czipx.Unzip\u201d del creador de aplicaciones de Develar permite a un atacante sobrescribir archivos arbitrarios en macOS APFS explotando una Colisi\u00f3n de Normalizaci\u00f3n Unicode combinada con el comportamiento de seguimiento de enlaces simb\u00f3licos. APFS trata ciertos nombres de archivo equivalentes en Unicode como id\u00e9nticos (p. ej., \u00df ? ss), mientras que el creador de aplicaciones no realiza ninguna normalizaci\u00f3n can\u00f3nica antes de validar o escribir rutas. Como resultado, un archivo ZIP manipulado que contenga:\n\u2022\tuna entrada de enlace simb\u00f3lico llamada ss que apunta a un archivo objetivo, y\n\u2022\tun archivo regular llamado \u00df que contiene datos controlados por el atacante,\nhar\u00e1 que la segunda escritura siga el enlace simb\u00f3lico y sobrescriba el archivo objetivo."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "cret@cert.org"}