Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-89036 (GCVE-0-2026-89036)

Vulnerability from nvd – Published: 2026-09-17 15:54 – Updated: 2026-10-01 15:21 X_Open Source

Title

Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter

Summary

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application uses escapeshellcmd instead of escapeshellarg and fails to quote the parameter, allowing TAB characters to survive sanitization and be interpreted as argument separators, enabling injection of arbitrary GNU tar arguments such as --checkpoint-action=exec to achieve remote code execution as the builds worker process user.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 17:01 UTC

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

VulnCheck mitre root Scorecard

References

4 references

URL	Tags
https://github.com/appwrite/appwrite/releases#rel…	release-notes
https://github.com/appwrite/appwrite/pull/13028	issue-trackingpatch
https://github.com/appwrite/appwrite/commit/a82dc…	patch
https://www.vulncheck.com/advisories/appwrite-arg…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
appwrite	appwrite	Affected: 0 , < 2.0.0 (semver) cpe:2.3:a:appwrite:appwrite::::::::

Date Public

2026-07-28 00:00

Credits

Alpesh Bhagwatkar

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89036",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T17:01:26.669709Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T17:14:30.233Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/appwrite/appwrite",
          "product": "appwrite",
          "repo": "https://github.com/appwrite/appwrite",
          "vendor": "appwrite",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alpesh Bhagwatkar"
        }
      ],
      "datePublic": "2026-07-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application uses escapeshellcmd instead of escapeshellarg and fails to quote the parameter, allowing TAB characters to survive sanitization and be interpreted as argument separators, enabling injection of arbitrary GNU tar arguments such as --checkpoint-action=exec to achieve remote code execution as the builds worker process user."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T15:21:54.929Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Release Tag",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/appwrite/appwrite/releases#release-2.0.0"
        },
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/appwrite/appwrite/pull/13028"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/appwrite/appwrite/commit/a82dc6e386a6ac7b88e853a1e6fdb59e0b79ddca"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/appwrite-argument-injection-via-providerrootdirectory-parameter"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Appwrite \u003c 2.0.0 Argument Injection via providerRootDirectory Parameter",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-89036",
    "datePublished": "2026-09-17T15:54:46.106Z",
    "dateReserved": "2026-09-10T16:23:54.472Z",
    "dateUpdated": "2026-10-01T15:21:54.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-72861 (GCVE-0-2026-72861)

Vulnerability from nvd – Published: 2026-08-20 19:48 – Updated: 2026-09-24 14:19

Title

Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

Summary

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || (await verify(...))", so when the X-Hub-Signature-256 header is absent the first operand is true, the logical OR short-circuits, and the function reports success without performing any HMAC verification. main.js rejects a request only when verifyWebhook returns false, so an unauthenticated request carrying no signature passes the check. Processing then continues to postComment, which takes the repository and issue objects directly from the request body, letting the caller direct the deployed function to post a comment on a repository and issue of their choosing using the configured GITHUB_TOKEN, with the issue author login from the body interpolated into the comment text.

Severity

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 21:33 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

VulnCheck mitre root Scorecard

References

6 references

URL	Tags
https://github.com/appwrite/templates/issues/350	issue-tracking
https://github.com/appwrite/templates/blob/1.1.2/…	technical-description
https://github.com/appwrite/templates/blob/1.1.2/…	technical-description
https://github.com/appwrite/templates/blob/1.1.2/…	technical-description
https://github.com/appwrite/templates	product
https://www.vulncheck.com/advisories/appwrite-tem…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
appwrite	templates	Affected: 0 , ≤ 1.1.2 (semver)

Date Public

2026-05-26 00:00

Credits

potdf-bl4ck-570rm

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72861",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T21:33:32.540767Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T21:45:50.993Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "templates",
          "programFiles": [
            "node/github-issue-bot/src/github.js",
            "node-typescript/github-issue-bot/src/github.ts"
          ],
          "repo": "https://github.com/appwrite/templates",
          "vendor": "appwrite",
          "versions": [
            {
              "lessThanOrEqual": "1.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "potdf-bl4ck-570rm"
        }
      ],
      "datePublic": "2026-05-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns \"typeof signature !== \u0027string\u0027 || (await verify(...))\", so when the X-Hub-Signature-256 header is absent the first operand is true, the logical OR short-circuits, and the function reports success without performing any HMAC verification. main.js rejects a request only when verifyWebhook returns false, so an unauthenticated request carrying no signature passes the check. Processing then continues to postComment, which takes the repository and issue objects directly from the request body, letting the caller direct the deployed function to post a comment on a repository and issue of their choosing using the configured GITHUB_TOKEN, with the issue author login from the body interpolated into the comment text."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T14:19:05.054Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #350",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/appwrite/templates/issues/350"
        },
        {
          "name": "verifyWebhook in the node template at 1.1.2",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/appwrite/templates/blob/1.1.2/node/github-issue-bot/src/github.js"
        },
        {
          "name": "verifyWebhook in the node-typescript template at 1.1.2",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/appwrite/templates/blob/1.1.2/node-typescript/github-issue-bot/src/github.ts"
        },
        {
          "name": "main.js gating on verifyWebhook and calling postComment",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/appwrite/templates/blob/1.1.2/node/github-issue-bot/src/main.js"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/appwrite/templates"
        },
        {
          "name": "VulnCheck Advisory: Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/appwrite-templates-github-issue-bot-skips-webhook-signature-verification-when-the-x-hub-signature-256-header-is-absent"
        }
      ],
      "title": "Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-72861",
    "datePublished": "2026-08-20T19:48:51.102Z",
    "dateReserved": "2026-08-10T15:16:31.372Z",
    "dateUpdated": "2026-09-24T14:19:05.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-25377 (GCVE-0-2022-25377)

Vulnerability from nvd – Published: 2024-02-22 00:00 – Updated: 2024-08-21 17:46

Summary

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.)

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-21 14:55 UTC

CWE

n/a
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

mitre mitre root Scorecard

References

4 references

URL	Tags
https://github.com/appwrite/appwrite/blob/0.12.0/…
https://github.com/appwrite/appwrite/releases/tag…
https://github.com/appwrite/appwrite/pull/2780
https://dubell.io/unauthenticated-lfi-in-appwrite…

Impacted products

1 product

Vendor	Product	Version
appwrite	appwrite	Affected: 0.5.0 , < 0.12.2 (custom) cpe:2.3:a:appwrite:appwrite::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:36:06.926Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite/blob/0.12.0/app/controllers/general.php#L539"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite/releases/tag/0.12.2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite/pull/2780"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://dubell.io/unauthenticated-lfi-in-appwrite-0.5.0-0.12.1/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "appwrite",
            "vendor": "appwrite",
            "versions": [
              {
                "lessThan": "0.12.2",
                "status": "affected",
                "version": "0.5.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-25377",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-21T14:55:02.173775Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-21T17:46:27.441Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let\u0027s Encrypt certificates via Appwrite.)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-22T21:43:34.974Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/appwrite/appwrite/blob/0.12.0/app/controllers/general.php#L539"
        },
        {
          "url": "https://github.com/appwrite/appwrite/releases/tag/0.12.2"
        },
        {
          "url": "https://github.com/appwrite/appwrite/pull/2780"
        },
        {
          "url": "https://dubell.io/unauthenticated-lfi-in-appwrite-0.5.0-0.12.1/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-25377",
    "datePublished": "2024-02-22T00:00:00.000Z",
    "dateReserved": "2022-02-20T00:00:00.000Z",
    "dateUpdated": "2024-08-21T17:46:27.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-1063 (GCVE-0-2024-1063)

Vulnerability from nvd – Published: 2024-01-30 09:20 – Updated: 2025-05-29 15:05

Summary

Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-08 15:42 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

tenable mitre root Scorecard

References

1 reference

URL	Tags
https://www.tenable.com/security/research/tra-2024-03

Impacted products

1 product

Vendor	Product	Version
Appwrite	Appwrite	Affected: 0 , ≤ 1.4.13 (1.4.13)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:26:30.422Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/research/tra-2024-03"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1063",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T15:42:37.956884Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-29T15:05:40.384Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Appwrite",
          "repo": "https://github.com/appwrite/appwrite",
          "vendor": "Appwrite",
          "versions": [
            {
              "lessThanOrEqual": "1.4.13",
              "status": "affected",
              "version": "0",
              "versionType": "1.4.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAppwrite \u0026lt;= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the \u0027/v1/avatars/favicon\u0027 endpoint due to an incomplete fix of CVE-2023-27159.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Appwrite \u003c= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the \u0027/v1/avatars/favicon\u0027 endpoint due to an incomplete fix of CVE-2023-27159.\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-30T09:20:26.210Z",
        "orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
        "shortName": "tenable"
      },
      "references": [
        {
          "url": "https://www.tenable.com/security/research/tra-2024-03"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
    "assignerShortName": "tenable",
    "cveId": "CVE-2024-1063",
    "datePublished": "2024-01-30T09:20:26.210Z",
    "dateReserved": "2024-01-30T08:48:25.261Z",
    "dateUpdated": "2025-05-29T15:05:40.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-50974 (GCVE-0-2023-50974)

Vulnerability from nvd – Published: 2024-01-09 00:00 – Updated: 2025-06-17 16:02

Summary

In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-27 16:01 UTC

CWE

n/a
CWE-798 - Use of Hard-coded Credentials

Assigner

mitre mitre root Scorecard

References

2 references

URL	Tags
https://gist.github.com/SkypLabs/72ee00ecfa7d1a34…
https://appwrite.io/docs/tooling/command-line/ins…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:23:44.139Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/SkypLabs/72ee00ecfa7d1a3494e2d69a24279c1d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://appwrite.io/docs/tooling/command-line/installation"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-50974",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-27T16:01:54.666779Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-798",
                "description": "CWE-798 Use of Hard-coded Credentials",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T16:02:00.408Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-09T08:36:25.462Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://gist.github.com/SkypLabs/72ee00ecfa7d1a3494e2d69a24279c1d"
        },
        {
          "url": "https://appwrite.io/docs/tooling/command-line/installation"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-50974",
    "datePublished": "2024-01-09T00:00:00.000Z",
    "dateReserved": "2023-12-17T00:00:00.000Z",
    "dateUpdated": "2025-06-17T16:02:00.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-27159 (GCVE-0-2023-27159)

Vulnerability from nvd – Published: 2023-03-31 00:00 – Updated: 2026-07-09 00:24

Previdian

Summary

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-18 15:08 UTC

CWE

n/a
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

mitre mitre root Scorecard

References

4 references

URL	Tags
https://github.com/appwrite/appwrite
https://notes.sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKA
https://gist.github.com/b33t1e/e9e8192317c111e789…
https://gist.github.com/b33t1e/43b26c31e895baf7e7…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-09T00:24:27.951Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://notes.sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKA"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/b33t1e/e9e8192317c111e7897e04d2f9bf5fdb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/b33t1e/43b26c31e895baf7e7aea2dbf9743a9a"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-27159",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-18T15:08:46.423908Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-918",
                "description": "CWE-918 Server-Side Request Forgery (SSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-18T15:09:58.974Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-05T00:16:51.194Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/appwrite/appwrite"
        },
        {
          "url": "https://notes.sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKA"
        },
        {
          "url": "https://gist.github.com/b33t1e/e9e8192317c111e7897e04d2f9bf5fdb"
        },
        {
          "url": "https://gist.github.com/b33t1e/43b26c31e895baf7e7aea2dbf9743a9a"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-27159",
    "datePublished": "2023-03-31T00:00:00.000Z",
    "dateReserved": "2023-02-27T00:00:00.000Z",
    "dateUpdated": "2026-07-09T00:24:27.951Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-2925 (GCVE-0-2022-2925)

Vulnerability from nvd – Published: 2022-09-09 05:25 – Updated: 2024-08-03 00:52

Title

Cross-site Scripting (XSS) - Stored in appwrite/appwrite

Summary

Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.

Severity

9 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

@huntrdev Scorecard

References

2 references

URL	Tags
https://huntr.dev/bounties/a3b4148f-165f-4583-abe…	x_refsource_CONFIRM
https://github.com/appwrite/appwrite/commit/b5b4d…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
appwrite	appwrite/appwrite	Affected: unspecified , < 1.0.0-RC1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:52:59.827Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/a3b4148f-165f-4583-abed-5568696d99dc"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite/commit/b5b4d92623c13fa8e5c71736db461e81fb7a7ade"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "appwrite/appwrite",
          "vendor": "appwrite",
          "versions": [
            {
              "lessThan": "1.0.0-RC1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-09T05:25:08.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/a3b4148f-165f-4583-abed-5568696d99dc"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/appwrite/appwrite/commit/b5b4d92623c13fa8e5c71736db461e81fb7a7ade"
        }
      ],
      "source": {
        "advisory": "a3b4148f-165f-4583-abed-5568696d99dc",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site Scripting (XSS) - Stored in appwrite/appwrite",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2022-2925",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting (XSS) - Stored in appwrite/appwrite"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "appwrite/appwrite",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.0.0-RC1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "appwrite"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/a3b4148f-165f-4583-abed-5568696d99dc",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/a3b4148f-165f-4583-abed-5568696d99dc"
            },
            {
              "name": "https://github.com/appwrite/appwrite/commit/b5b4d92623c13fa8e5c71736db461e81fb7a7ade",
              "refsource": "MISC",
              "url": "https://github.com/appwrite/appwrite/commit/b5b4d92623c13fa8e5c71736db461e81fb7a7ade"
            }
          ]
        },
        "source": {
          "advisory": "a3b4148f-165f-4583-abed-5568696d99dc",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2022-2925",
    "datePublished": "2022-09-09T05:25:09.000Z",
    "dateReserved": "2022-08-22T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:52:59.827Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-23682 (GCVE-0-2021-23682)

Vulnerability from nvd – Published: 2022-02-16 17:05 – Updated: 2024-09-16 20:17

Title

Prototype Pollution

Summary

This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P

CWE

Prototype Pollution

Assigner

snyk mitre root Scorecard

References

6 references

URL	Tags
https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250	x_refsource_MISC
https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820	x_refsource_MISC
https://github.com/litespeed-js/litespeed.js/pull/18	x_refsource_MISC
https://github.com/appwrite/appwrite/releases/tag…	x_refsource_MISC
https://github.com/appwrite/appwrite/pull/2778	x_refsource_MISC
https://github.com/appwrite/appwrite/releases/tag…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
n/a	litespeed.js	Affected: unspecified , < 0.3.12 (custom)
n/a	appwrite/server-ce	Affected: 0.12.0 , < unspecified (custom) Affected: unspecified , < 0.12.2 (custom) Affected: unspecified , < 0.11.1 (custom)

Date Public

2022-02-16 00:00

Credits

Alessio Della Libera of Snyk Research Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:14:09.152Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/litespeed-js/litespeed.js/pull/18"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite/releases/tag/0.12.2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite/pull/2778"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite/releases/tag/0.11.1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "litespeed.js",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "0.3.12",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "appwrite/server-ce",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "0.12.0",
              "versionType": "custom"
            },
            {
              "lessThan": "0.12.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "0.11.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Alessio Della Libera of Snyk Research Team"
        }
      ],
      "datePublic": "2022-02-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 6.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Prototype Pollution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-16T17:05:26.000Z",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/litespeed-js/litespeed.js/pull/18"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/appwrite/appwrite/releases/tag/0.12.2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/appwrite/appwrite/pull/2778"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/appwrite/appwrite/releases/tag/0.11.1"
        }
      ],
      "title": "Prototype Pollution",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "report@snyk.io",
          "DATE_PUBLIC": "2022-02-16T17:03:36.924290Z",
          "ID": "CVE-2021-23682",
          "STATE": "PUBLIC",
          "TITLE": "Prototype Pollution"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "litespeed.js",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "0.3.12"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "appwrite/server-ce",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "0.12.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "0.12.2"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "0.11.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Alessio Della Libera of Snyk Research Team"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Prototype Pollution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250",
              "refsource": "MISC",
              "url": "https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250"
            },
            {
              "name": "https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820",
              "refsource": "MISC",
              "url": "https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820"
            },
            {
              "name": "https://github.com/litespeed-js/litespeed.js/pull/18",
              "refsource": "MISC",
              "url": "https://github.com/litespeed-js/litespeed.js/pull/18"
            },
            {
              "name": "https://github.com/appwrite/appwrite/releases/tag/0.12.2",
              "refsource": "MISC",
              "url": "https://github.com/appwrite/appwrite/releases/tag/0.12.2"
            },
            {
              "name": "https://github.com/appwrite/appwrite/pull/2778",
              "refsource": "MISC",
              "url": "https://github.com/appwrite/appwrite/pull/2778"
            },
            {
              "name": "https://github.com/appwrite/appwrite/releases/tag/0.11.1",
              "refsource": "MISC",
              "url": "https://github.com/appwrite/appwrite/releases/tag/0.11.1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2021-23682",
    "datePublished": "2022-02-16T17:05:26.116Z",
    "dateReserved": "2021-01-08T00:00:00.000Z",
    "dateUpdated": "2024-09-16T20:17:30.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-89036 (GCVE-0-2026-89036)

Vulnerability from cvelistv5 – Published: 2026-09-17 15:54 – Updated: 2026-10-01 15:21 X_Open Source

Title

Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter

Summary

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application uses escapeshellcmd instead of escapeshellarg and fails to quote the parameter, allowing TAB characters to survive sanitization and be interpreted as argument separators, enabling injection of arbitrary GNU tar arguments such as --checkpoint-action=exec to achieve remote code execution as the builds worker process user.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 17:01 UTC

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

VulnCheck mitre root Scorecard

References

4 references

URL	Tags
https://github.com/appwrite/appwrite/releases#rel…	release-notes
https://github.com/appwrite/appwrite/pull/13028	issue-trackingpatch
https://github.com/appwrite/appwrite/commit/a82dc…	patch
https://www.vulncheck.com/advisories/appwrite-arg…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
appwrite	appwrite	Affected: 0 , < 2.0.0 (semver) cpe:2.3:a:appwrite:appwrite::::::::

Date Public

2026-07-28 00:00

Credits

Alpesh Bhagwatkar

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89036",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T17:01:26.669709Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T17:14:30.233Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/appwrite/appwrite",
          "product": "appwrite",
          "repo": "https://github.com/appwrite/appwrite",
          "vendor": "appwrite",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alpesh Bhagwatkar"
        }
      ],
      "datePublic": "2026-07-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application uses escapeshellcmd instead of escapeshellarg and fails to quote the parameter, allowing TAB characters to survive sanitization and be interpreted as argument separators, enabling injection of arbitrary GNU tar arguments such as --checkpoint-action=exec to achieve remote code execution as the builds worker process user."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T15:21:54.929Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Release Tag",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/appwrite/appwrite/releases#release-2.0.0"
        },
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/appwrite/appwrite/pull/13028"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/appwrite/appwrite/commit/a82dc6e386a6ac7b88e853a1e6fdb59e0b79ddca"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/appwrite-argument-injection-via-providerrootdirectory-parameter"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Appwrite \u003c 2.0.0 Argument Injection via providerRootDirectory Parameter",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-89036",
    "datePublished": "2026-09-17T15:54:46.106Z",
    "dateReserved": "2026-09-10T16:23:54.472Z",
    "dateUpdated": "2026-10-01T15:21:54.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-72861 (GCVE-0-2026-72861)

Vulnerability from cvelistv5 – Published: 2026-08-20 19:48 – Updated: 2026-09-24 14:19

Title

Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

Summary

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || (await verify(...))", so when the X-Hub-Signature-256 header is absent the first operand is true, the logical OR short-circuits, and the function reports success without performing any HMAC verification. main.js rejects a request only when verifyWebhook returns false, so an unauthenticated request carrying no signature passes the check. Processing then continues to postComment, which takes the repository and issue objects directly from the request body, letting the caller direct the deployed function to post a comment on a repository and issue of their choosing using the configured GITHUB_TOKEN, with the issue author login from the body interpolated into the comment text.

Severity

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 21:33 UTC

CWE

CWE-347 - Improper Verification of Cryptographic Signature

Assigner

VulnCheck mitre root Scorecard

References

6 references

URL	Tags
https://github.com/appwrite/templates/issues/350	issue-tracking
https://github.com/appwrite/templates/blob/1.1.2/…	technical-description
https://github.com/appwrite/templates/blob/1.1.2/…	technical-description
https://github.com/appwrite/templates/blob/1.1.2/…	technical-description
https://github.com/appwrite/templates	product
https://www.vulncheck.com/advisories/appwrite-tem…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
appwrite	templates	Affected: 0 , ≤ 1.1.2 (semver)

Date Public

2026-05-26 00:00

Credits

potdf-bl4ck-570rm

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72861",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T21:33:32.540767Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T21:45:50.993Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "templates",
          "programFiles": [
            "node/github-issue-bot/src/github.js",
            "node-typescript/github-issue-bot/src/github.ts"
          ],
          "repo": "https://github.com/appwrite/templates",
          "vendor": "appwrite",
          "versions": [
            {
              "lessThanOrEqual": "1.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "potdf-bl4ck-570rm"
        }
      ],
      "datePublic": "2026-05-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns \"typeof signature !== \u0027string\u0027 || (await verify(...))\", so when the X-Hub-Signature-256 header is absent the first operand is true, the logical OR short-circuits, and the function reports success without performing any HMAC verification. main.js rejects a request only when verifyWebhook returns false, so an unauthenticated request carrying no signature passes the check. Processing then continues to postComment, which takes the repository and issue objects directly from the request body, letting the caller direct the deployed function to post a comment on a repository and issue of their choosing using the configured GITHUB_TOKEN, with the issue author login from the body interpolated into the comment text."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T14:19:05.054Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #350",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/appwrite/templates/issues/350"
        },
        {
          "name": "verifyWebhook in the node template at 1.1.2",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/appwrite/templates/blob/1.1.2/node/github-issue-bot/src/github.js"
        },
        {
          "name": "verifyWebhook in the node-typescript template at 1.1.2",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/appwrite/templates/blob/1.1.2/node-typescript/github-issue-bot/src/github.ts"
        },
        {
          "name": "main.js gating on verifyWebhook and calling postComment",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/appwrite/templates/blob/1.1.2/node/github-issue-bot/src/main.js"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/appwrite/templates"
        },
        {
          "name": "VulnCheck Advisory: Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/appwrite-templates-github-issue-bot-skips-webhook-signature-verification-when-the-x-hub-signature-256-header-is-absent"
        }
      ],
      "title": "Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-72861",
    "datePublished": "2026-08-20T19:48:51.102Z",
    "dateReserved": "2026-08-10T15:16:31.372Z",
    "dateUpdated": "2026-09-24T14:19:05.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-25377 (GCVE-0-2022-25377)

Vulnerability from cvelistv5 – Published: 2024-02-22 00:00 – Updated: 2024-08-21 17:46

Summary

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.)

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-21 14:55 UTC

CWE

n/a
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

mitre mitre root Scorecard

References

4 references

URL	Tags
https://github.com/appwrite/appwrite/blob/0.12.0/…
https://github.com/appwrite/appwrite/releases/tag…
https://github.com/appwrite/appwrite/pull/2780
https://dubell.io/unauthenticated-lfi-in-appwrite…

Impacted products

1 product

Vendor	Product	Version
appwrite	appwrite	Affected: 0.5.0 , < 0.12.2 (custom) cpe:2.3:a:appwrite:appwrite::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:36:06.926Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite/blob/0.12.0/app/controllers/general.php#L539"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite/releases/tag/0.12.2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite/pull/2780"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://dubell.io/unauthenticated-lfi-in-appwrite-0.5.0-0.12.1/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:appwrite:appwrite:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "appwrite",
            "vendor": "appwrite",
            "versions": [
              {
                "lessThan": "0.12.2",
                "status": "affected",
                "version": "0.5.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-25377",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-21T14:55:02.173775Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-21T17:46:27.441Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let\u0027s Encrypt certificates via Appwrite.)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-22T21:43:34.974Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/appwrite/appwrite/blob/0.12.0/app/controllers/general.php#L539"
        },
        {
          "url": "https://github.com/appwrite/appwrite/releases/tag/0.12.2"
        },
        {
          "url": "https://github.com/appwrite/appwrite/pull/2780"
        },
        {
          "url": "https://dubell.io/unauthenticated-lfi-in-appwrite-0.5.0-0.12.1/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-25377",
    "datePublished": "2024-02-22T00:00:00.000Z",
    "dateReserved": "2022-02-20T00:00:00.000Z",
    "dateUpdated": "2024-08-21T17:46:27.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-1063 (GCVE-0-2024-1063)

Vulnerability from cvelistv5 – Published: 2024-01-30 09:20 – Updated: 2025-05-29 15:05

Summary

Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-08 15:42 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

tenable mitre root Scorecard

References

1 reference

URL	Tags
https://www.tenable.com/security/research/tra-2024-03

Impacted products

1 product

Vendor	Product	Version
Appwrite	Appwrite	Affected: 0 , ≤ 1.4.13 (1.4.13)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:26:30.422Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/research/tra-2024-03"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1063",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T15:42:37.956884Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-29T15:05:40.384Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Appwrite",
          "repo": "https://github.com/appwrite/appwrite",
          "vendor": "Appwrite",
          "versions": [
            {
              "lessThanOrEqual": "1.4.13",
              "status": "affected",
              "version": "0",
              "versionType": "1.4.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAppwrite \u0026lt;= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the \u0027/v1/avatars/favicon\u0027 endpoint due to an incomplete fix of CVE-2023-27159.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "Appwrite \u003c= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the \u0027/v1/avatars/favicon\u0027 endpoint due to an incomplete fix of CVE-2023-27159.\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-30T09:20:26.210Z",
        "orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
        "shortName": "tenable"
      },
      "references": [
        {
          "url": "https://www.tenable.com/security/research/tra-2024-03"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
    "assignerShortName": "tenable",
    "cveId": "CVE-2024-1063",
    "datePublished": "2024-01-30T09:20:26.210Z",
    "dateReserved": "2024-01-30T08:48:25.261Z",
    "dateUpdated": "2025-05-29T15:05:40.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-50974 (GCVE-0-2023-50974)

Vulnerability from cvelistv5 – Published: 2024-01-09 00:00 – Updated: 2025-06-17 16:02

Summary

In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-27 16:01 UTC

CWE

n/a
CWE-798 - Use of Hard-coded Credentials

Assigner

mitre mitre root Scorecard

References

2 references

URL	Tags
https://gist.github.com/SkypLabs/72ee00ecfa7d1a34…
https://appwrite.io/docs/tooling/command-line/ins…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:23:44.139Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/SkypLabs/72ee00ecfa7d1a3494e2d69a24279c1d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://appwrite.io/docs/tooling/command-line/installation"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-50974",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-27T16:01:54.666779Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-798",
                "description": "CWE-798 Use of Hard-coded Credentials",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T16:02:00.408Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-09T08:36:25.462Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://gist.github.com/SkypLabs/72ee00ecfa7d1a3494e2d69a24279c1d"
        },
        {
          "url": "https://appwrite.io/docs/tooling/command-line/installation"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-50974",
    "datePublished": "2024-01-09T00:00:00.000Z",
    "dateReserved": "2023-12-17T00:00:00.000Z",
    "dateUpdated": "2025-06-17T16:02:00.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-27159 (GCVE-0-2023-27159)

Vulnerability from cvelistv5 – Published: 2023-03-31 00:00 – Updated: 2026-07-09 00:24

Previdian

Summary

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-18 15:08 UTC

CWE

n/a
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

mitre mitre root Scorecard

References

4 references

URL	Tags
https://github.com/appwrite/appwrite
https://notes.sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKA
https://gist.github.com/b33t1e/e9e8192317c111e789…
https://gist.github.com/b33t1e/43b26c31e895baf7e7…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-09T00:24:27.951Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://notes.sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKA"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/b33t1e/e9e8192317c111e7897e04d2f9bf5fdb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gist.github.com/b33t1e/43b26c31e895baf7e7aea2dbf9743a9a"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-27159",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-18T15:08:46.423908Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-918",
                "description": "CWE-918 Server-Side Request Forgery (SSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-18T15:09:58.974Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-05T00:16:51.194Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/appwrite/appwrite"
        },
        {
          "url": "https://notes.sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKA"
        },
        {
          "url": "https://gist.github.com/b33t1e/e9e8192317c111e7897e04d2f9bf5fdb"
        },
        {
          "url": "https://gist.github.com/b33t1e/43b26c31e895baf7e7aea2dbf9743a9a"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-27159",
    "datePublished": "2023-03-31T00:00:00.000Z",
    "dateReserved": "2023-02-27T00:00:00.000Z",
    "dateUpdated": "2026-07-09T00:24:27.951Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-2925 (GCVE-0-2022-2925)

Vulnerability from cvelistv5 – Published: 2022-09-09 05:25 – Updated: 2024-08-03 00:52

Title

Cross-site Scripting (XSS) - Stored in appwrite/appwrite

Summary

Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.

Severity

9 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

@huntrdev Scorecard

References

2 references

URL	Tags
https://huntr.dev/bounties/a3b4148f-165f-4583-abe…	x_refsource_CONFIRM
https://github.com/appwrite/appwrite/commit/b5b4d…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
appwrite	appwrite/appwrite	Affected: unspecified , < 1.0.0-RC1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:52:59.827Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/a3b4148f-165f-4583-abed-5568696d99dc"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite/commit/b5b4d92623c13fa8e5c71736db461e81fb7a7ade"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "appwrite/appwrite",
          "vendor": "appwrite",
          "versions": [
            {
              "lessThan": "1.0.0-RC1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-09T05:25:08.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/a3b4148f-165f-4583-abed-5568696d99dc"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/appwrite/appwrite/commit/b5b4d92623c13fa8e5c71736db461e81fb7a7ade"
        }
      ],
      "source": {
        "advisory": "a3b4148f-165f-4583-abed-5568696d99dc",
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site Scripting (XSS) - Stored in appwrite/appwrite",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2022-2925",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site Scripting (XSS) - Stored in appwrite/appwrite"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "appwrite/appwrite",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.0.0-RC1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "appwrite"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/a3b4148f-165f-4583-abed-5568696d99dc",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/a3b4148f-165f-4583-abed-5568696d99dc"
            },
            {
              "name": "https://github.com/appwrite/appwrite/commit/b5b4d92623c13fa8e5c71736db461e81fb7a7ade",
              "refsource": "MISC",
              "url": "https://github.com/appwrite/appwrite/commit/b5b4d92623c13fa8e5c71736db461e81fb7a7ade"
            }
          ]
        },
        "source": {
          "advisory": "a3b4148f-165f-4583-abed-5568696d99dc",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2022-2925",
    "datePublished": "2022-09-09T05:25:09.000Z",
    "dateReserved": "2022-08-22T00:00:00.000Z",
    "dateUpdated": "2024-08-03T00:52:59.827Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-23682 (GCVE-0-2021-23682)

Vulnerability from cvelistv5 – Published: 2022-02-16 17:05 – Updated: 2024-09-16 20:17

Title

Prototype Pollution

Summary

This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P

CWE

Prototype Pollution

Assigner

snyk mitre root Scorecard

References

6 references

URL	Tags
https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250	x_refsource_MISC
https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820	x_refsource_MISC
https://github.com/litespeed-js/litespeed.js/pull/18	x_refsource_MISC
https://github.com/appwrite/appwrite/releases/tag…	x_refsource_MISC
https://github.com/appwrite/appwrite/pull/2778	x_refsource_MISC
https://github.com/appwrite/appwrite/releases/tag…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
n/a	litespeed.js	Affected: unspecified , < 0.3.12 (custom)
n/a	appwrite/server-ce	Affected: 0.12.0 , < unspecified (custom) Affected: unspecified , < 0.12.2 (custom) Affected: unspecified , < 0.11.1 (custom)

Date Public

2022-02-16 00:00

Credits

Alessio Della Libera of Snyk Research Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:14:09.152Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/litespeed-js/litespeed.js/pull/18"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite/releases/tag/0.12.2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite/pull/2778"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/appwrite/appwrite/releases/tag/0.11.1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "litespeed.js",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "0.3.12",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "appwrite/server-ce",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "0.12.0",
              "versionType": "custom"
            },
            {
              "lessThan": "0.12.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "0.11.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Alessio Della Libera of Snyk Research Team"
        }
      ],
      "datePublic": "2022-02-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "remediationLevel": "NOT_DEFINED",
            "reportConfidence": "NOT_DEFINED",
            "scope": "UNCHANGED",
            "temporalScore": 6.9,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Prototype Pollution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-16T17:05:26.000Z",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/litespeed-js/litespeed.js/pull/18"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/appwrite/appwrite/releases/tag/0.12.2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/appwrite/appwrite/pull/2778"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/appwrite/appwrite/releases/tag/0.11.1"
        }
      ],
      "title": "Prototype Pollution",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "report@snyk.io",
          "DATE_PUBLIC": "2022-02-16T17:03:36.924290Z",
          "ID": "CVE-2021-23682",
          "STATE": "PUBLIC",
          "TITLE": "Prototype Pollution"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "litespeed.js",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "0.3.12"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "appwrite/server-ce",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "0.12.0"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "0.12.2"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "0.11.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Alessio Della Libera of Snyk Research Team"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Prototype Pollution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250",
              "refsource": "MISC",
              "url": "https://snyk.io/vuln/SNYK-JS-LITESPEEDJS-2359250"
            },
            {
              "name": "https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820",
              "refsource": "MISC",
              "url": "https://snyk.io/vuln/SNYK-PHP-APPWRITESERVERCE-2401820"
            },
            {
              "name": "https://github.com/litespeed-js/litespeed.js/pull/18",
              "refsource": "MISC",
              "url": "https://github.com/litespeed-js/litespeed.js/pull/18"
            },
            {
              "name": "https://github.com/appwrite/appwrite/releases/tag/0.12.2",
              "refsource": "MISC",
              "url": "https://github.com/appwrite/appwrite/releases/tag/0.12.2"
            },
            {
              "name": "https://github.com/appwrite/appwrite/pull/2778",
              "refsource": "MISC",
              "url": "https://github.com/appwrite/appwrite/pull/2778"
            },
            {
              "name": "https://github.com/appwrite/appwrite/releases/tag/0.11.1",
              "refsource": "MISC",
              "url": "https://github.com/appwrite/appwrite/releases/tag/0.11.1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2021-23682",
    "datePublished": "2022-02-16T17:05:26.116Z",
    "dateReserved": "2021-01-08T00:00:00.000Z",
    "dateUpdated": "2024-09-16T20:17:30.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

16 vulnerabilities by appwrite

CVE-2026-89036 (GCVE-0-2026-89036)

CVE-2026-72861 (GCVE-0-2026-72861)

CVE-2022-25377 (GCVE-0-2022-25377)

CVE-2024-1063 (GCVE-0-2024-1063)

CVE-2023-50974 (GCVE-0-2023-50974)

CVE-2023-27159 (GCVE-0-2023-27159)

CVE-2022-2925 (GCVE-0-2022-2925)

CVE-2021-23682 (GCVE-0-2021-23682)

CVE-2026-89036 (GCVE-0-2026-89036)

CVE-2026-72861 (GCVE-0-2026-72861)

CVE-2022-25377 (GCVE-0-2022-25377)

CVE-2024-1063 (GCVE-0-2024-1063)

CVE-2023-50974 (GCVE-0-2023-50974)

CVE-2023-27159 (GCVE-0-2023-27159)

CVE-2022-2925 (GCVE-0-2022-2925)

CVE-2021-23682 (GCVE-0-2021-23682)