The vulnerability exists in the zipx.Unzip extraction routine of Develar's app-builder on macOS APFS. APFS treats certain Unicode equivalent filenames as identical (e.g., ß and ss), but the app-builder does not perform canonical Unicode normalization before validating or writing extracted paths. An attacker can craft a ZIP archive containing a symlink entry named ss pointing to a target file and a regular file named ß with attacker-controlled content. When extracted, the app-builder writes the ß file, which follows the symlink ss and overwrites the target file, leading to arbitrary file overwrite. This is a CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-59 (Improper Link Resolution) vulnerability. There is no CVSS score or vendor patch information available at this time.

Successful exploitation allows an attacker to overwrite arbitrary files on a system running macOS with APFS by exploiting Unicode normalization collisions and symlink following during ZIP extraction. This can lead to unauthorized modification of files, potentially impacting system integrity or application behavior. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when extracting ZIP archives from untrusted sources on macOS systems using Develar's app-builder. No official vendor advisory or patch has been provided at this time.