Skip to main content

CISA alerts on arbitrary file overwrite in Develar app-builder

Source Decision Insights Threat Desk Published August 23, 2026 Companies 2
Human View Machine View

2 companies named across 2 categories, one of 71 articles referencing GitHub. Previous coverage: Teleport Adds Linux Desktop Support in Infrastructure Identity Platform (Aug 2026).

Companies mentioned

Best suited for

Seniority
C Level / Executive Team
Job function
Chief Information Security Officer
Persona
Security Architect
Buyer role
Architect / Technical Evaluator
Decision stage
How to start
Adoption curve
Early Adopters
Technology maturity
Emerging Exploration
Industry
Information Technology / Software & Services / IT Services / Cloud Services

Our classification, not the publisher's statement. Best suited for, not only for.

Develar app-builder contains a vulnerability in the zipx.Unzip extraction routine that can allow an attacker to overwrite arbitrary files on macOS systems that use Apple File System (APFS). The issue involves Unicode normalization collisions and symlink-following behavior during ZIP extraction, which can redirect writes outside the intended extraction directory.

The vulnerability is tracked as CVE-2026-13723. In Develar app-builder, the zipx.Unzip routine handles Unicode-equivalent filenames and symbolic links during ZIP extraction without performing canonical normalization before validating or writing output paths. APFS treats certain Unicode representations as identical (for example, ß and ss), which can combine with malicious symlinks in crafted ZIP archives to bypass path-validation checks and redirect writes outside the intended extraction directory. A GitHub Pull Request addresses the symlink-following variant of the vulnerability (CWE-22 and CWE-59) by rejecting any symlink whose resolved target escapes the intended output directory and by adding O_NOFOLLOW to regular file writes. The attacker can exploit the condition during ZIP extraction without requiring elevated privileges.

Exploitation allows an attacker to overwrite arbitrary files on macOS systems using APFS. The advisory notes that the outcome may include loss of integrity, denial of service, or potential code execution depending on which files are overwritten.

Develar has not responded to several emails or to issues posted in the GitHub repository requesting contact. The reporter developed a Pull Request to provide downstream customers with a reference fix and to enable analysis of the vulnerable code or implementation of their own patches at https://github.com/develar/app-builder/pull/163. A complete remediation requires fixing the vulnerability at its source.

CERT/CC thanks the reporter, Tomas Illuminati, Cyber Security Researcher and Threat Intelligence Specialist, for assisting downstream vendors and developers in mitigating this issue. CERT/CC also thanks Electron-Userland for responding quickly and implementing a mitigation to protect their downstream users.

Blog post, originally published at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-alerts-on-arbitrary-file-overwrite-in-develar-app-builder/",
        "name": "CISA alerts on arbitrary file overwrite in Develar app-builder",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-alerts-on-arbitrary-file-overwrite-in-develar-app-builder/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/microsoft/github/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/github/",
      "name": "GitHub"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "C Level / Executive Team"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Chief Information Security Officer"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Architect"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Architect / Technical Evaluator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Adopters"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Emerging Exploration"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Cloud Services"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T12:30:38-06:00",
    "datePublished": "2026-08-23T09:43:10-06:00",
    "description": "CISA reports a Develar app-builder issue in zipx.Unzip on macOS using APFS, involving Unicode normalization collisions and symlink following.",
    "headline": "CISA alerts on arbitrary file overwrite in Develar app-builder",
    "isBasedOn": {
      "@type": "CreativeWork",
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/293714"
    },
    "keywords": [
      "Normalization",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-alerts-on-arbitrary-file-overwrite-in-develar-app-builder/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/microsoft/github/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/github/",
        "name": "GitHub"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages