TI-2026-60343 Aliases CVE-2026-89036 GHSA-qqx6-v32j-728q

Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter

MEDIUM 41CWE-88Published 2026-09-17 · Updated 2026-10-01

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-88.

Summary

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application uses escapeshellcmd instead of escapeshellarg and fails to quote the parameter, allowing TAB characters to survive sanitization and be interpreted as argument separators, enabling injection of arbitrary GNU tar arguments such as --checkpoint-action=exec to achieve remote code execution as the builds worker process user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00702 53rd percentileScored 2026-11-07

Fix Fixed appwrite (appwrite): 2.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
appwrite	appwrite	before 2.0.0	2.0.0	Patch available	CNA

appwrite Vendorappwrite Affected before 2.0.0 Fixed in 2.0.0 Patch available CNA

Remediation

Fix · CNA appwrite (appwrite) Fixed in 2.0.0

Timeline

2026-10-02 Threatist record created from CVE-2026-89036
2026-10-03 Alias added: GHSA-qqx6-v32j-728q

References

Patch 2

Other 1

Release Tag

TI-2023-11948 Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via… CVSS 3.1HIGH 7.5
TI-2022-09061 The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote… CVSS 3.1HIGH 7.5
TI-2023-27861 In Appwrite CLI before 3.0.0, when using the login command, the credentials of the… CVSS 3.1MEDIUM 5.5
TI-2021-06180 Prototype pollution in litespeed.js CVSS 3.1CRITICAL 9.8
TI-2024-00984 Server-side request forgery in Appwrite CVSS 3.1HIGH 7.5
TI-2026-51085 Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent CVSS 4.0MEDIUM 6.9

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences