CVE-2026-89036High· 8.8▾ TwilightAppwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory p…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.7%
Last analysed / modified upstream
0.7% → 1.3%
Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application uses escapeshellcmd instead of escapeshellarg and fails to quote the parameter, allowing TAB characters to survive sanitization and be interpreted as argument separators, enabling injection of arbitrary GNU tar arguments such as --checkpoint-action=exec to achieve remote code execution as the builds worker process user.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108770Medium· 5.3A weakness has been identified in Appwrite up to 2.3.0
CVE-2025-59937Critical· 9.1go-mail is a comprehensive library for sending mails with Go
CVE-2026-72861Medium· 5.8The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition
CVE-2026-50056High· 7.8Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injection
CVE-2026-115372High· 8.5github.com/lxc/incus: Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options (CVE-2026-115372)
CVE-2026-111813Critical· 10.0Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration