🔐 CVE Alert

CVE-2026-89036

HIGH 8.8

Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter

CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application uses escapeshellcmd instead of escapeshellarg and fails to quote the parameter, allowing TAB characters to survive sanitization and be interpreted as argument separators, enabling injection of arbitrary GNU tar arguments such as --checkpoint-action=exec to achieve remote code execution as the builds worker process user.

CWE CWE-88
Vendor appwrite
Product appwrite
Published Sep 17, 2026
Last Updated Sep 17, 2026
Stay Ahead of the Next One

Get instant alerts for appwrite appwrite

Be the first to know when new high vulnerabilities affecting appwrite appwrite are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected Versions

appwrite / appwrite
0 < 2.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/appwrite/appwrite/releases#release-2.0.0 github.com: https://github.com/appwrite/appwrite/pull/13028 github.com: https://github.com/appwrite/appwrite/commit/a82dc6e386a6ac7b88e853a1e6fdb59e0b79ddca vulncheck.com: https://www.vulncheck.com/advisories/appwrite-argument-injection-via-providerrootdirectory-parameter

Credits

Alpesh Bhagwatkar