Vulnerabilities

TI-2026-60343 CVE-2026-89036 · GHSA-qqx6-v32j-728q

Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter

MEDIUM 41

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the provid…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00702 Published 2026-09-17 Fixed in 2.0.0 CWE-88

TI-2026-51085 CVE-2026-72861 · GHSA-785c-v4m5-q4wg

Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

LOW 36

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00269 Published 2026-08-20 No fix listed CWE-347

TI-2022-09061 CVE-2022-25377 · GHSA-wfm3-gq9h-mrjm

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote…

HIGH 72

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00793 Published 2024-02-22 Fixed in 0.12.2 CWE-22

TI-2024-00984 CVE-2024-1063 · GHSA-vrjf-gppf-qvj4

Server-side request forgery in Appwrite

LOW 39

Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00445 Published 2024-01-30 No fix listed CWE-918

TI-2023-27861 CVE-2023-50974 · GHSA-g777-crp9-m27g

In Appwrite CLI before 3.0.0, when using the login command, the credentials of the…

MEDIUM 58

In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00293 Published 2024-01-09 Fixed in 3.0.0 CWE-798

TI-2023-11948 CVE-2023-27159 · GHSA-hxgx-584x-vwm8

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via…

HIGH 72

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.36419 Published 2023-03-31 No fix listed CWE-918

TI-2022-02705 CVE-2022-2925 · GHSA-5ffj-mph5-c5hv

Cross-site Scripting (XSS) - Stored in appwrite/appwrite

LOW 26

Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00847 Published 2022-09-09 Fixed in 1.0.0-RC1 CWE-79

TI-2021-06180 CVE-2021-23682 · GHSA-v9p9-535w-4285

Prototype pollution in litespeed.js

MEDIUM 46

This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02117 Published 2022-02-16 Fixed in 0.3.12, 0.12.2 +1 CWE-1321

Vulnerabilities

Filters