CVE-2026-89036

8.8 HIGHpublic exploit available

Published 2026-09-17 · Updated 2026-09-22

AI risk analysis

Summary: This vulnerability allows authenticated users to inject TAB characters into the providerRootDirectory parameter, leading to remote code execution as the builds worker process user.
Exploitability: Exploitation requires authenticated access with functions.write or sites.write permissions and knowledge of the specific parameter injection technique.
Blast radius: If exploited, this could result in unauthorized remote code execution, potentially leading to full system compromise.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Appwrite 2.0.0 or later.

rceauth-bypassweb

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application uses escapeshellcmd instead of escapeshellarg and fails to quote the parameter, allowing TAB characters to survive sanitization and be interpreted as argument separators, enabling injection of arbitrary GNU tar arguments such as --checkpoint-action=exec to achieve remote code execution as the builds worker process user.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-88

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.