CVE-2026-89036

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-89036
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89036.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-89036
Published
2026-09-17T15:54:46Z
Modified
2026-09-18T03:48:38Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter
Details

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application uses escapeshellcmd instead of escapeshellarg and fails to quote the parameter, allowing TAB characters to survive sanitization and be interpreted as argument separators, enabling injection of arbitrary GNU tar arguments such as --checkpoint-action=exec to achieve remote code execution as the builds worker process user.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-88"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89036.json"
}
References

Affected packages

Git / github.com/appwrite/appwrite

Affected ranges

Type
GIT
Repo
https://github.com/appwrite/appwrite
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
033c6303e352b9307f0e53fff15fb631882674d6
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.1.13
0.1.15
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.11.0
0.12.0
0.12.1
0.13.0
0.13.1
0.13.2
0.13.3
0.13.4
0.14.0
0.14.1
0.14.2
0.15.0
0.15.1
0.15.2
0.2.0
0.3.0
0.4.0
0.5.0
0.5.1
0.5.2
0.5.3
0.6.0
0.6.2
0.7.0
0.7.1
0.7.2
0.8.0
0.9
0.9.0
0.9.1
0.9.2
0.9.3
1.*
1.0.0
1.0.1
1.1.1
1.1.2
1.2.0
1.3.0
1.3.1
1.3.2
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.6.0-RC8
1.7.0
1.7.1
1.7.2
1.7.3
2.*
2.0.0-rc.3
cl-1.*
cl-1.4.26
cl-1.4.3
cl-1.4.6+1
cl-1.4.6+3
cl-1.4.6-2
cl-1.4.7+4
cl-1.4.7+5
cl-1.4.7+6
cl-1.4.8+2
cl-1.4.8+3
cl-1.4.9+2
cl-1.9.6-1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89036.json"