https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T00:16:22.093271+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-275739 EUVD-2026-275739 2026-10-06T00:16:22.170705+00:00 EUVD-2026-275739 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30973 fkie_cve-2026-30973 2026-10-06T00:16:22.170742+00:00

Appium is an automation framework that provides WebDriver-based automation possibilities for a wide range platforms. Prior to 7.0.6, @appium/support contains a ZIP extraction implementation (extractAllTo() via ZipExtractor.extract()) with a path traversal (Zip Slip) check that is non-functional. The check at line 88 of packages/support/lib/zip.js creates an Error object but never throws it, allowing malicious ZIP entries with ../ path components to write files outside the intended destination directory. This affects all JS-based extractions (the default code path), not only those using the fileNamesEncoding option. This vulnerability is fixed in 7.0.6.

 https://cve.radiocsirt.org/vuln/ghsa-rfx7-4xw3-gh4m GHSA-rfx7-4xw3-gh4m — @appium/support has a Zip Slip arbitrary file write in its ZIP extraction 2026-10-06T00:16:22.170776+00:00

Affected: npm: @appium/support

## Summary

`@appium/support` contains a ZIP extraction implementation (`extractAllTo()` via `ZipExtractor.extract()`) with a path traversal (Zip Slip) check that is non-functional. The check at line 88 of `packages/support/lib/zip.js` creates an `Error` object but never throws it, allowing malicious ZIP entries with `../` path components to write files outside the intended destination directory. This affects all JS-based extractions (the default code path), not only those using the `fileNamesEncoding` option.

## Severity

**Medium** (CVSS 3.1: 6.5)

`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`

- **Attack Vector:** Network — malicious ZIP files can be supplied over the network (e.g., app packages via URL) - **Attack Complexity:** Low — no special conditions required beyond providing a crafted ZIP - **Privileges Required:** None — no authentication needed to supply a malicious archive - **User Interaction:** Required — a user or automation system must initiate extraction of the attacker's archive - **Scope:** Unchanged — impact stays within the file system permissions of the Appium process - **Confidentiality Impact:** None — the vulnerability enables file writes, not reads - **Integrity Impact:** High — arbitrary file write to any location writable by the process - **Availability Impact:** None — no direct availability impact

## Affected Component

- `packages/support/lib/zip.js` — `ZipExtractor.extract()` (line 88) and `ZipExtractor.extractEntry()` (lines 111-145)

##…