Skip to content
Threat Feed
Subscribe

Vendor

Appium

2 briefs RSS
high advisory

Arbitrary File Write in appium-mcp-server via Path Traversal

The appium-mcp-server package up to version 0.1.61 contains a path traversal vulnerability in file writing tools, allowing unauthenticated attackers to overwrite sensitive system files.

appium-mcp-server vulnerability path-traversal appium cve-2026-84201
2t 1c
high advisory

Appium Java Client Allows Network Pivot via Unvalidated directConnect Redirect (CVE-2026-43910)

A vulnerability, CVE-2026-43910, in Appium's java-client allows a malicious Appium server to redirect all subsequent session traffic to an arbitrary internal endpoint by injecting unvalidated `directConnectHost` and `directConnectPort` parameters when `directConnect(true)` is enabled, potentially leading to session traffic interception, network pivoting, and cloud credential theft.

java-client supply-chain vulnerability network-pivot credential-theft java CI/CD
3t 1i