Appwrite vulnerabilities
We track 4 vulnerabilities in Appwrite products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 17, 2026.
Latest Appwrite vulnerabilities
- 8.8 High severity
appwrite: Improper Neutralization of Argument Delimiters in a Command
Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to constr
- 7.5 High severity
appwrite: Improper Limitation of a Pathname to a Restricted Directory
The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (Th
- 7.5 High severity
Appwrite: Server-Side Request Forgery
Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159.
- 7.5 High severity
Appwrite: Server-Side Request Forgery
Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.