Path Traversal in Develar App-builder
CVE-2026-13723
A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS tr…
Vulnerability class: Path Traversal (Directory Traversal)
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.
Affected products
- Develar App-builder — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-13723?
- CVE-2026-13723 is a medium-severity vulnerability in Develar App-builder, classified under Path Traversal. CVSS score: 6.5/10. Published 2026-07-29.
- How severe is CVE-2026-13723?
- Medium severity. CVSS v3 base score is 6.5 out of 10.