Path Traversal Vulnerability in Appium MCP Server by Argneshu

CVE-2026-84201

What is CVE-2026-84201?

The Appium MCP Server up to version 0.1.61 exposes a critical vulnerability that fails to properly validate or normalize file paths within its write_file and write_files_batch functions. This oversight enables malicious actors to exploit the server's file management capabilities by supplying crafted absolute or relative file paths, potentially allowing unauthorized access to sensitive areas outside the designated PROJECT_ROOT directory. As a result, attackers can overwrite crucial files, including configuration files and shell profiles, with the privileges of the server user, which could lead to severe security compromises.

References