Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the zipx.Unzip process. An attacker can overwrite arbitrary files on macOS APFS by crafting a ZIP archive that exploits Unicode normalization collisions and symlink following, allowing the attacker to control file...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the zipx.Unzip process. An attacker can overwrite arbitrary files on macOS APFS by crafting a ZIP archive that exploits Unicode normalization collisions and symlink following, allowing the attacker to control file...

Arbitrary File Overwrite in Develar app-builder (zipx.Unzip) via Symlink Following on macOS (APFS)

Overview A vulnerability in the zipx.Unzip extraction routine of Develar’s app-builder allows an attacker to overwrite arbitrary files on macOS using Apple File System APFS. The issue arises from a combination of Unicode normalization collisions and unsafe symlink-following behavior. APFS treats...