CVE-2026-13723

Name of the Vulnerable Software and Affected Versions Develar's app-builder (affected versions not specified)

Description A flaw in the zipx.Unzip extraction routine allows an attacker to overwrite arbitrary files on macOS APFS. This occurs due to a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical, but the software fails to perform canonical normalization before validating or writing paths. An attacker can exploit this by creating a ZIP archive containing a symlink named ss pointing to a target file and a regular file named ß containing malicious data, causing the system to follow the symlink and overwrite the target file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.