Executive brief
appium-mcp-server is a Python library that provides file write functionality through its write_file and write_files_batch tools. A flaw in path validation allows attackers to overwrite arbitrary files on the system with the privileges of the server process, potentially compromising system configuration files and shell profiles used for account access and system control.
Technical details
The vulnerability is a path traversal flaw affecting the write_file and write_files_batch tools. The server fails to properly validate or normalize file paths before writing, allowing attackers to supply absolute paths or relative paths containing parent directory sequences (e.g., "../") to escape the intended PROJECT_ROOT directory and write files elsewhere on the filesystem. An attacker with access to invoke these tools can overwrite arbitrary files with the server process user's privileges, including critical configuration and shell profile files. No precondition of authentication is noted in the advisory, suggesting network-accessible exposure is possible depending on deployment context.
Affected products
- argneshu appium-mcp-server through 0.1.61
Timeline
- 2026-09-01: disclosed