A flaw in Develar's app-builder zip extraction routine allows an attacker to overwrite any file on the APFS file system by exploiting a Unicode Normalization Collision combined with symbolic link following. The validator does not canonicalise filenames before checking or writing them, so a malicious ZIP containing a symlink to a target file and a regular file whose Unicode‑normalized name matches the symlink can force the extractor to overwrite the target with attacker supplied data. This is a denial of service to file integrity and can be leveraged to modify binaries or configuration files, potentially leading to privilege escalation or code execution if the overwritten files are later executed.

The vulnerability affects Develar’s app-builder product used on macOS when it runs on an APFS file system. No specific version numbers are disclosed, so any build process that uses app-builder on macOS and extracts ZIP archives is potentially impacted.

The CVSS score of 6.5 reflects a moderate severity; the EPSS score of less than 1 percent indicates a very low probability of exploitation at the time of analysis. It is not listed in CISA’s KEV catalog, suggesting no documented exploits. Attacks would require an attacker to supply a crafted ZIP file to the build tool, usually during a local or continuous‑integration build; the attacker must have access to the host where the build runs. The risk is therefore confined to build environments, but the potential to overwrite critical runtime files makes it a significant concern for continuous‑integration pipelines that import untrusted artifacts.