CVE-2026-13723 Develar's electron-builder allows arbitrary file overwrite
Attackers can overwrite arbitrary files on macOS by exploiting Unicode normalization collisions and symlink following in the ZIP extraction routine.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13723?
CVE-2026-13723 is a medium-severity path traversal vulnerability in Develar app-builder, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing: • a symlink entry named ss pointing to a target file, and • a regular file named ß containing attacker controlled data, will cause the second write to follow the symlink and overwrite the target file.
Which versions are affected by CVE-2026-13723?
How do I fix CVE-2026-13723?
No fix has been published for CVE-2026-13723 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-13723 being exploited?
There is no known exploitation of CVE-2026-13723 in the wild and no public exploit code.
Sources
Also known as GHSA-m52r-27c6-4q88.