Appwrite - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/appwrite/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 17 Sep 2026 17:58:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-89036 Argument Injection in Appwritehttps://feed.craftedsignal.io/briefs/2026-09-appwrite-argument-injection/Thu, 17 Sep 2026 17:58:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-appwrite-argument-injection/Authenticated users can achieve remote code execution in Appwrite versions before 2.0.0 by exploiting an argument injection vulnerability via the providerRootDirectory parameter in GNU tar commands.Appwrite versions prior to 2.0.0 contain a critical argument injection vulnerability (CVE-2026-89036) that permits authenticated users with functions.write or sites.write permissions to achieve remote code execution (RCE). The vulnerability stems from the improper sanitization of the providerRootDirectory parameter, which is passed to system commands executing GNU tar. Specifically, the application utilizes the PHP function escapeshellcmd rather than escapeshellarg and fails to wrap the parameter in quotes. This allows an attacker to inject TAB characters, which bypass existing filters and are interpreted as argument separators by the underlying shell. By injecting arbitrary GNU tar arguments, such as --checkpoint-action=exec, an attacker can execute arbitrary code under the context of the builds worker process user. This vulnerability is particularly significant due to the elevated privileges afforded to the builds worker process, potentially allowing for full system compromise within the Appwrite environment.

Attack Chain

  1. An attacker obtains or utilizes a valid account with 'functions.write' or 'sites.write' permissions.
  2. The attacker interacts with the application API or UI to configure the 'providerRootDirectory' setting.
  3. The attacker submits a specially crafted 'providerRootDirectory' payload containing one or more TAB characters (0x09) followed by malicious GNU tar flags.
  4. The Appwrite application processes the input using 'escapeshellcmd', which fails to neutralize the injected TAB characters or prevent argument injection.
  5. The application constructs a system command string including the tainted 'providerRootDirectory' parameter.
  6. The shell executes the command, interpreting the TAB-separated segments as distinct arguments to the 'tar' binary.
  7. The 'tar' binary processes the injected '--checkpoint-action=exec' flag.
  8. The 'tar' utility spawns an external process to execute attacker-supplied commands, granting the attacker RCE as the 'builds worker' process user.

Impact

Successful exploitation allows for remote code execution on the server running the Appwrite 'builds worker' process. This could lead to full compromise of the affected Appwrite installation, unauthorized access to sensitive application data, exfiltration of environment variables or secrets, and the potential for lateral movement within the hosting infrastructure.

Recommendation

  • Upgrade Appwrite to version 2.0.0 or later immediately to patch the argument injection vulnerability.
  • Audit access logs for the 'functions.write' and 'sites.write' endpoints to identify suspicious attempts to modify configuration parameters containing control characters like TAB.
  • Monitor the 'builds worker' process for the spawning of unexpected child processes or command-line execution patterns associated with 'tar' flags such as '--checkpoint-action'.
  • Restrict permissions for users within the Appwrite console, ensuring the principle of least privilege is applied to those with configuration write access.
]]>highadvisoryvulnerabilityrceargument-injectionappwrite