Read the docs

appwrite

Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

appwrite records in CISA KEV

No appwrite vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Appwrite 5 records HIGH Command Line Interface 1 record MEDIUM

Records

8 records

TI-2021-06180 CVE-2021-23682 · GHSA-v9p9-535w-4285

Prototype pollution in litespeed.js

Priority MEDIUM 46

This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02117 Published 2022-02-16 Fixed in 0.3.12, 0.12.2 +1 CWE-1321
TI-2026-60343 CVE-2026-89036 · GHSA-qqx6-v32j-728q

Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter

Priority MEDIUM 41

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the provid…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00702 Published 2026-09-17 Fixed in 2.0.0 CWE-88
TI-2024-00984 CVE-2024-1063 · GHSA-vrjf-gppf-qvj4

Server-side request forgery in Appwrite

Priority LOW 39

Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00445 Published 2024-01-30 No fix listed CWE-918
TI-2022-02705 CVE-2022-2925 · GHSA-5ffj-mph5-c5hv

Cross-site Scripting (XSS) - Stored in appwrite/appwrite

Priority LOW 26

Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00847 Published 2022-09-09 Fixed in 1.0.0-RC1 CWE-79
Open these records in search →