A vulnerability has been discovered in Develar's app-builder, a command-line build tool used to package and distribute application bundles for macOS, Windows, and Linux. The issue arises from a combination of Unicode normalization collisions and unsafe symlink-following behavior in the zipx.Unzip extraction routine. This allows an attacker to overwrite arbitrary files on macOS systems using Apple File System (APFS) by crafting ZIP archives that combine Unicode normalization collisions with malicious symlinks. The vulnerability is exploitable during ZIP extraction without requiring elevated privileges and can result in loss of integrity, denial of service, or potential code execution. Develar's app-builder is widely used as a dependency across the ecosystem, affecting numerous downstream repositories, and several projects have already mitigated their exposure. A complete remediation requires fixing the vulnerability at its source, and a GitHub Pull Request has been developed to provide downstream customers with a reference fix. The Pull Request addresses the symlink-following variant of the vulnerability by rejecting any symlink whose resolved target escapes the intended output directory and by adding O_NOFOLLOW to regular file writes. The reporter, Tomas Illuminati, has assisted many downstream vendors and developers in mitigating this issue, and Electron-Userland has responded quickly and implemented a mitigation to protect their downstream users. The vulnerability can be exploited by combining Unicode normalization collisions with symlink-following behavior, allowing an attacker to bypass path-validation checks and redirect writes outside the intended extraction directory. The CERT/CC has prepared a vulnerability note to inform users of the issue and provide guidance on mitigation and remediation. Overall, the vulnerability has significant implications for the security of macOS systems using APFS, and users are advised to take steps to mitigate their exposure.