VU#293714: Arbitrary File Overwrite in Develar app-builder (zipx.Unzip) via Symlink Following on macOS (APFS)

Develar app-builder contains a vulnerability in the zipx.Unzip extraction routine that can allow an attacker to overwrite arbitrary files on macOS systems that use Apple File System (APFS). The issue involves Unicode normalization collisions and symlink-following behavior during ZIP extraction, which can redirect writes outside the intended extraction directory.

The vulnerability is tracked as CVE-2026-13723. In Develar app-builder, the zipx.Unzip routine handles Unicode-equivalent filenames and symbolic links during ZIP extraction without performing canonical normalization before validating or writing output paths. APFS treats certain Unicode representations as identical (for example, ß and ss), which can combine with malicious symlinks in crafted ZIP archives to bypass path-validation checks and redirect writes outside the intended extraction directory. A GitHub Pull Request addresses the symlink-following variant of the vulnerability (CWE-22 and CWE-59) by rejecting any symlink whose resolved target escapes the intended output directory and by adding O_NOFOLLOW to regular file writes. The attacker can exploit the condition during ZIP extraction without requiring elevated privileges.

Exploitation allows an attacker to overwrite arbitrary files on macOS systems using APFS. The advisory notes that the outcome may include loss of integrity, denial of service, or potential code execution depending on which files are overwritten.

Develar has not responded to several emails or to issues posted in the GitHub repository requesting contact. The reporter developed a Pull Request to provide downstream customers with a reference fix and to enable analysis of the vulnerable code or implementation of their own patches at https://github.com/develar/app-builder/pull/163. A complete remediation requires fixing the vulnerability at its source.

CERT/CC thanks the reporter, Tomas Illuminati, Cyber Security Researcher and Threat Intelligence Specialist, for assisting downstream vendors and developers in mitigating this issue. CERT/CC also thanks Electron-Userland for responding quickly and implementing a mitigation to protect their downstream users.