{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13723", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-06-29T14:24:39.792Z", "datePublished": "2026-07-29T17:25:22.185Z", "dateUpdated": "2026-07-29T18:21:44.159Z"}, "containers": {"cna": {"title": "Develar's electron-builder allows arbitrary file overwrite", "descriptions": [{"lang": "en", "value": "A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., \u00df \u2194 ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing:\r\n\u2022\ta symlink entry named ss pointing to a target file, and\r\n\u2022\ta regular file named \u00df containing attacker controlled data,\r\nwill cause the second write to follow the symlink and overwrite the target file."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Develar", "product": "app-builder", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "4.2.0", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}], "references": [{"url": "https://github.com/develar/app-builder"}, {"url": "http://kb.cert.org/vuls/id/293714"}, {"url": "https://github.com/develar/app-builder/pull/163"}], "x_generator": {"engine": "VINCE 3.0.43", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-13723"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-29T17:25:22.185Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/293714"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-29T18:20:56.270Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-59", "lang": "en", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T18:21:31.256338Z", "id": "CVE-2026-13723", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T18:21:44.159Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/293714"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-29T18:20:56.270Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-13723", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T18:21:31.256338Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T18:20:32.978Z"}}], "cna": {"title": "Develar's electron-builder allows arbitrary file overwrite", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Develar", "product": "app-builder", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "4.2.0"}]}], "references": [{"url": "https://github.com/develar/app-builder"}, {"url": "http://kb.cert.org/vuls/id/293714"}, {"url": "https://github.com/develar/app-builder/pull/163"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.43", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-13723"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., \u00df \u2194 ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing:\r\n\u2022\ta symlink entry named ss pointing to a target file, and\r\n\u2022\ta regular file named \u00df containing attacker controlled data,\r\nwill cause the second write to follow the symlink and overwrite the target file."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-29T17:25:22.185Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13723", "state": "PUBLISHED", "dateUpdated": "2026-07-29T18:21:44.159Z", "dateReserved": "2026-06-29T14:24:39.792Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-07-29T17:25:22.185Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "app-builder", "vendor": "Develar", "versions": [{"lessThanOrEqual": "4.2.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., \u00df \u2194 ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing:\r\n\u2022\ta symlink entry named ss pointing to a target file, and\r\n\u2022\ta regular file named \u00df containing attacker controlled data,\r\nwill cause the second write to follow the symlink and overwrite the target file."}], "id": "CVE-2026-13723", "lastModified": "2026-07-30T19:10:06.847", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13723", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-29T18:21:31.256338Z", "version": "2.0.3"}}]}, "published": "2026-07-29T18:16:50.603", "references": [{"source": "[email protected]", "url": "http://kb.cert.org/vuls/id/293714"}, {"source": "[email protected]", "url": "https://github.com/develar/app-builder"}, {"source": "[email protected]", "url": "https://github.com/develar/app-builder/pull/163"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.kb.cert.org/vuls/id/293714"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-59"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.2.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "app-builder", "source": "cna", "vendor": "Develar"}, "product": "app-builder", "vendor": "develar"}], "created": "2026-07-30T14:01:45.416176+00:00", "updated": "2026-08-03T13:15:05.181917+00:00", "vendors": ["develar", "develar$PRODUCT$app-builder"]}