Executive brief
Appwrite is a popular backend-as-a-service platform for building web and mobile applications. A vulnerability in versions before 2.0.0 allows authenticated users with specific permissions to execute arbitrary commands on the server by injecting malicious arguments into tar commands, potentially taking over the underlying system used to process builds and functions.
Technical details
This is an argument injection vulnerability in Appwrite's handling of the providerRootDirectory parameter used when constructing GNU tar commands. The root cause is improper input sanitization: the application uses escapeshellcmd() instead of escapeshellarg() and fails to quote the parameter value. This allows TAB characters to survive sanitization and be interpreted as argument separators by the shell, enabling injection of arbitrary GNU tar options such as --checkpoint-action=exec. Exploitation requires authentication and either functions.write or sites.write permissions. An attacker can achieve remote code execution in the context of the builds worker process. The vulnerability was patched in version 2.0.0 via removal of the executor build backend (commit a82dc6e, merged July 28, 2026).
Affected products
- Appwrite Appwrite before 2.0.0
Timeline
- 2026-09-17: disclosed
- 2026-07-28: patched: Fix merged in version 2.0.0