News, updates, trends and the latest
info you need to know about IT

Overview
A vulnerability in the zipx.Unzip extraction routine of Develar’s app-builder allows an attacker to overwrite arbitrary files on macOS using Apple File System (APFS). The issue arises from a combination of Unicode normalization collisions and unsafe symlink-following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths.
Description
Develar’s app-builder is a command‑line build tool used heavily in the Electron ecosystem to package, sign, notarize, and produce distributable application bundles for macOS, Windows, and Linux. It is popular because it is a transitive dependency of electron-builder, one of the most widely used packaging tools for Electron apps.
The vulnerability arises from how the zipx.Unzip routine handles Unicode‑equivalent filenames and symbolic links during ZIP extraction. APFS treats certain Unicode representations as identical (e.g., ß and ss), but app-builder does not perform canonical normalization before validating output paths. As a result, an attacker can craft ZIP archives that combine Unicode normalization collisions with malicious symlinks to redirect writes outside the intended extraction directory.
The GitHub Pull Request addresses the symlink-following variant of this vulnerability (CWE‑22 and CWE‑59) by rejecting any symlink whose resolved target escapes the intended output directory and by adding O_NOFOLLOW to regular file writes. Without these protections, an attacker can craft ZIP archives containing malicious symlinks and Unicode-colliding filenames to overwrite arbitrary files on APFS-backed systems.
Impact
Exploitation of this vulnerability allows an attacker to overwrite arbitrary files on macOS systems using APFS. By combining Unicode normalization collisions with symlink‑following behavior in the zipx.Unzip routine, an attacker can craft ZIP archives that bypass path‑validation checks and redirect writes outside the intended extraction directory. This may result in loss of integrity, denial of service, or potential code execution, depending on which files are overwritten. Because APFS treats certain Unicode‑equivalent filenames as identical, the attack can evade typical sanitization logic unless canonical normalization is enforced. The vulnerability is exploitable during ZIP extraction without requiring elevated privileges.
Supply-chain Impact
Develar’s app-builder is widely used as a dependency across the ecosystem, affecting numerous downstream repositories. Several projects have already mitigated their exposure, while others may still be affected. A complete remediation requires fixing the vulnerability at its source.
Solution
Develar has not responded to several emails or to issues posted in the GitHub repository requesting contact. The reporter has developed a Pull Request to provide downstream customers with a reference fix and to enable them to analyze the vulnerable code or implement their own patches: https://github.com/develar/app-builder/pull/163
Acknowledgements
CERT/CC thanks the reporter, Tomas Illuminati, Cyber Security Researcher & Threat Intelligence Specialist, for assisting many downstream vendors and developers in mitigating this issue.
We also thank Electron-Userland for responding quickly and implementing a mitigation to protect their downstream users.
This AI-assisted vulnerability note was prepared by Laurie Tyzenhaus.

Overview
A vulnerability has been discovered in the OPeNDAP Hyrax software solution. A remote attacker with the ability to submit crafted requests to an affected Hyrax instance could cause the application to communicate with unauthorized remote systems. Under certain conditions, the vulnerability may also result in the unintended disclosure of user authentication tokens to unauthorized destinations.
Description
CVE-2026-16637
OPeNDAP Hyrax is vulnerable to Server Side Request Forgery (SSRF) and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints.
OPeNDAP Hyrax is an open-source data server software that enables remote access to scientific datasets over the internet using the OPeNDAP protocol. It allows users to query, subset, and retrieve data in various formats (such as NetCDF, HDF, or GrADS) without downloading entire files. OPeNDAP Hyrax uses a list of allowed hosts, specified through a regular expression, to limit where it can fetch data. When a requested server responds with a redirect, HTTP 3xx, the software follows the redirect without checking whether the new destination is still on the allowed list. This behavior enables an attacker to redirect the system to an untrusted or internal target that would otherwise be blocked. Additionally, when the system follows such a redirect, it may carry certain user identification headers, including a legacy credential called Echo-Token, to the new destination, even though the main authorization token is correctly stripped by the underlying library.
Impact
Successful exploitation could allow an unauthenticated remote attacker to access internal services that are not intended to be reachable from the internet. If a user is authenticated when exploitation occurs, the attacker may also obtain the user’s Earthdata identifier and a reusable legacy credential. These credentials could be used to access protected datasets or other resources as the affected user.
Solution
The CERT/CC is currently unaware of a practical solution to this problem. OPeNDAP has been notified and is working to develop a patch that will be released shortly, if it hasn’t already. Administrator of Hyrax server are advised to review their allowed host configurations carefully and consider limiting exposure of the gateway endpoint to trusted networks until the fix is available, likely in versions Hyrax-1.18.0 or later.
Acknowledgements
Thanks to the Juan Salvador Sleibe for reporting this issue. This AI-assisted document was written by Timur Snoke.

Overview
Firmware versions 2.7.7 and earlier of the Arris BGW210-700 residential gateway contain an authentication bypass vulnerability, tracked as CVE-2026-16771, that allows any unauthenticated LAN-side user to read sensitive configuration data and modify device settings through web management endpoints. Although this vulnerability was recently discovered, the majority of in-service gateways are not expected to be running the affected version. Only devices that have not received automated ISP-managed firmware updates since version 2.7.7 in 2020 are vulnerable.
Description
The Arris BGW210-700 is a residential gateway used widely in AT&T deployments to provide routing, wireless networking, and wide-area network (WAN) connectivity for home users. The device exposes a browser-based management interface on the local-area network (LAN) side that allows users to configure WiFi settings, check diagnostics, and run system operations.
Several CGI (Common Gateway Interface) handlers within the BGW210-700’s web interface do not enforce any server-side authentication checks. Although the interface presents an “Access Code” prompt to users, this restriction is entirely implemented through client-side HTML and JavaScript and is not validated by the server before processing requests. As a result, any HTTP client that ignores client-side code can directly access and interact with the underlying CGI endpoints.
The lack of server-side authentication affects multiple configuration and diagnostic pages. The wconfig_unified.ha endpoint returns the plaintext WiFi pre-shared key for all configured SSIDs to any unauthenticated requester. The broadbandconfig.ha endpoint accepts unauthenticated POST requests that directly modify WAN configuration parameters, including settings that persist across device reboots. Additional diagnostic endpoints, such as diag.ha, allow unauthenticated triggering of backend diagnostic jobs.
Impact
This vulnerability allows any unauthenticated user on the LAN, including devices connected to the gateway through the main WiFi network, Guest WiFi network, or LAN ethernet, to read sensitive configuration information and make persistent changes to gateway settings. A local attacker can retrieve the network’s plaintext WiFi password with a single HTTP request and achieve unauthorized access to manipulate, intrude on, and interfere with protected networks.
Solution
This gateway is ISP-managed, so all standard internet-connected devices are expected to have been automatically updated to newer unaffected versions. Users can determine their active version by checking their router’s diagnostic settings via web browser, and optionally contact their ISP to confirm that automatic updates are functioning correctly. Because the vulnerability is limited to the LAN-side management interface, standard network hygiene practices such as isolating untrusted devices, keeping IoT systems updated, and monitoring for the presence of unknown clients can further reduce risk in environments where older firmware may still be present.
Acknowledgements
Thanks to David Weekly for researching and reporting this vulnerability. This document was written by Molly Jaconski.