{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/293714#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nA vulnerability in the `zipx.Unzip` extraction routine of Develar’s app-builder allows an attacker to overwrite arbitrary files on macOS using Apple File System (APFS). The issue arises from a combination of Unicode normalization collisions and unsafe symlink-following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths.\r\n### Description\r\nDevelar’s app-builder is a command‑line build tool used heavily in the Electron ecosystem to package, sign, notarize, and produce distributable application bundles for macOS, Windows, and Linux. It is popular because it is a transitive dependency of electron-builder, one of the most widely used packaging tools for Electron apps.\r\n\r\nThe vulnerability arises from how the `zipx.Unzip` routine handles Unicode‑equivalent filenames and symbolic links during ZIP extraction. APFS treats certain Unicode representations as identical (e.g., ß and ss), but app-builder does not perform canonical normalization before validating output paths. As a result, an attacker can craft ZIP archives that combine Unicode normalization collisions with malicious symlinks to redirect writes outside the intended extraction directory.\r\n\r\nThe GitHub Pull Request addresses the symlink-following variant of this vulnerability (CWE‑22 and CWE‑59) by rejecting any symlink whose resolved target escapes the intended output directory and by adding `O_NOFOLLOW` to regular file writes. Without these protections, an attacker can craft ZIP archives containing malicious symlinks and Unicode-colliding filenames to overwrite arbitrary files on APFS-backed systems.\r\n\r\n### Impact\r\nExploitation of this vulnerability allows an attacker to overwrite arbitrary files on macOS systems using APFS. By combining Unicode normalization collisions with symlink‑following behavior in the `zipx.Unzip` routine, an attacker can craft ZIP archives that bypass path‑validation checks and redirect writes outside the intended extraction directory. This may result in loss of integrity, denial of service, or potential code execution, depending on which files are overwritten. Because APFS treats certain Unicode‑equivalent filenames as identical, the attack can evade typical sanitization logic unless canonical normalization is enforced. The vulnerability is exploitable during ZIP extraction without requiring elevated privileges.\r\n\r\n#### Supply-chain Impact\r\nDevelar’s app-builder is widely used as a dependency across the ecosystem, affecting numerous downstream repositories. Several projects have already mitigated their exposure, while others may still be affected. A complete remediation requires fixing the vulnerability at its source.\r\n\r\n### Solution\r\nDevelar has not responded to several emails or to issues posted in the GitHub repository requesting contact. The reporter has developed a Pull Request to provide downstream customers with a reference fix and to enable them to analyze the vulnerable code or implement their own patches: https://github.com/develar/app-builder/pull/163\r\n\r\n### Acknowledgements\r\nCERT/CC thanks the reporter, Tomas Illuminati, Cyber Security Researcher & Threat Intelligence Specialist, for assisting many downstream vendors and developers in mitigating this issue.\r\n\r\nWe also thank Electron-Userland for responding quickly and implementing a mitigation to protect their downstream users.\r\n\r\nThis AI-assisted vulnerability note was prepared by Laurie Tyzenhaus.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/293714"},{"url":"https://github.com/develar/app-builder","summary":"https://github.com/develar/app-builder"},{"url":"http://kb.cert.org/vuls/id/293714","summary":"http://kb.cert.org/vuls/id/293714"}],"title":"Arbitrary File Overwrite in Develar app-builder (zipx.Unzip) via Symlink Following on macOS (APFS)","tracking":{"current_release_date":"2026-07-29T17:25:10+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.43"}},"id":"VU#293714","initial_release_date":"2026-07-29 17:25:10.776213+00:00","revision_history":[{"date":"2026-07-29T17:25:10+00:00","number":"1.20260729172510.1","summary":"Released on 2026-07-29T17:25:10+00:00"}],"status":"final","version":"1.20260729172510.1"}},"vulnerabilities":[{"title":"A vulnerability in the `zipx.","notes":[{"category":"summary","text":"A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing:\r\n•\ta symlink entry named ss pointing to a target file, and\r\n•\ta regular file named ß containing attacker controlled data,\r\nwill cause the second write to follow the symlink and overwrite the target file."}],"cve":"CVE-2026-13723","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#293714"}],"product_status":{"known_not_affected":["CSAFPID-2438d676-8b91-11f1-85eb-123eceb31d7b"]}}],"product_tree":{"branches":[{"category":"vendor","name":"Apple","product":{"name":"Apple Products","product_id":"CSAFPID-2438d676-8b91-11f1-85eb-123eceb31d7b"}}]}}