What is the CVSS score of CVE-2026-13723?

CVE-2026-13723 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

app-builder CVE-2026-13723

EUVD-2026-50423 MEDIUM

Path Traversal (CWE-22)

2026-07-29 certcc

GHSA-m52r-27c6-4q88

Canonical Apple Path Traversal App Builder

6.5

CVSS 3.1 · Vendor: certcc

Severity by source

Vendor (certcc) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

8.2 HIGH

Arbitrary overwrite of any file writable by the build process justifies I:H over NVD's I:L; no confidentiality impact; A:L for potential disruption of build artifacts.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jul 29, 2026 - 20:32 vuln.today

Analysis Generated

Jul 29, 2026 - 20:32 vuln.today

CVE Published

Jul 29, 2026 - 17:25 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 29, 2026 - 17:25 cve.org

MEDIUM 6.5

DescriptionCVE.org

A vulnerability in the zipx.Unzip extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing: • a symlink entry named ss pointing to a target file, and • a regular file named ß containing attacker controlled data, will cause the second write to follow the symlink and overwrite the target file.

AnalysisAI

Arbitrary file overwrite in Develar app-builder (all versions ≤ 4.2.0 on macOS) allows an unauthenticated remote attacker to escape the ZIP extraction directory by exploiting APFS Unicode case-folding combined with symlink following in the zipx.Unzip routine. A crafted archive containing a symlink entry ss pointing to an external victim file and a subsequent regular-file entry ß causes the builder to follow the symlink - because APFS folds ß to ss - overwriting the target with attacker-controlled content. SSVC rates the attack automatable with no confirmed exploitation; no public exploit code has been identified at time of analysis, though CERT/CC advisory VU#293714 and ENISA EUVD-2026-50423 confirm coordinated disclosure.

Technical ContextAI

The flaw resides in app-builder's zipx.Unzip extraction routine (CPE: cpe:2.3:a:develar:app-builder:*:*:*:*:*:*:*:*), a Go package used as the extraction engine in the Develar Electron application packaging toolchain. The root cause is CWE-22 (Path Traversal): the routine performs no Unicode canonical normalization before validating or writing extracted paths. Apple APFS and HFS+ implement full Unicode case folding at the filesystem layer, treating ß and ss as the same directory entry. When zipx.Unzip materializes a symlink entry (ss → external victim path), then subsequently opens the regular-file entry ß for writing without the O_NOFOLLOW flag, the kernel resolves ß to the pre-existing ss directory entry and follows the symlink to the external target. The fix introduced in PR #163 addresses both vectors: symlink entries whose resolved target escapes the output directory are rejected outright, and all regular-file writes are opened with O_NOFOLLOW, consistent with mitigations in node-tar and bsdtar.

RemediationAI

Apply the upstream fix from GitHub PR #163 (https://github.com/develar/app-builder/pull/163), which rejects symlink entries whose resolved target escapes the extraction output directory and enforces O_NOFOLLOW on all regular-file writes. A specific patched release version number is not confirmed in the available data - the PR changeset labels it a 'patch' release for app-builder-bin but no tagged version above 4.2.0 appears in the provided sources; monitor the repository and the CERT/CC advisory at https://www.kb.cert.org/vuls/id/293714 for a confirmed release. As an immediate compensating control, restrict ZIP archives processed by app-builder to trusted, integrity-verified origins (e.g., hash-checked or code-signed artifacts), which raises attacker cost without eliminating the flaw. Running app-builder under a least-privilege account with minimal filesystem write permissions on macOS CI runners limits the blast radius of a successful exploit, though this does not prevent exploitation of files writable by that account. Migrating macOS CI workloads to Linux runners entirely eliminates exposure for the duration before a patch is available.