Argument Injection Vulnerability in Appwrite by Appwrite

CVE-2026-89036

What is CVE-2026-89036?

The Appwrite application prior to version 2.0.0 is susceptible to an argument injection vulnerability. Authenticated users holding 'functions.write' or 'sites.write' permissions can exploit this flaw by injecting TAB characters into the 'providerRootDirectory' parameter. This parameter is improperly sanitized and utilized to construct GNU tar commands. Due to the use of escapeshellcmd instead of escapeshellarg, and the absence of proper quoting, TAB characters can bypass sanitization measures and be misinterpreted as argument separators. Consequently, this allows for the injection of arbitrary GNU tar commands, including potentially harmful actions such as '--checkpoint-action=exec', which could lead to remote code execution under the context of the builds worker process user.

References