CVE-2026-89036 Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter
Authenticated users can execute arbitrary commands via argument injection in the providerRootDirectory parameter, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-89036?
CVE-2026-89036 is a high-severity command injection vulnerability in appwrite, published on 17 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application uses escapeshellcmd instead of escapeshellarg and fails to quote the parameter, allowing TAB characters to survive sanitization and be interpreted as argument separators, enabling injection of arbitrary GNU tar arguments such as --checkpoint-action=exec to achieve remote code execution as the builds worker process user.
Weakness: CWE-88
Which versions are affected by CVE-2026-89036?
How do I fix CVE-2026-89036?
No fix has been published for CVE-2026-89036 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-89036 being exploited?
There is no known exploitation of CVE-2026-89036 in the wild and no public exploit code.
Sources
Also known as GHSA-qqx6-v32j-728q.