Path Traversal in Argneshu Appium-Mcp-Server
CVE-2026-84201
appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools, allowing attackers to write files outside the intended PROJECT_ROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite arbitrary files with the server user's privileges, including shell profiles and configuration files in the home directory.
Vulnerability class: Path Traversal (Directory Traversal)
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (technical-description)
- disclosure@vulncheck.com (technical-description)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-84201?
- CVE-2026-84201 is a high-severity vulnerability in Argneshu Appium-Mcp-Server, classified under Path Traversal. CVSS score: 7.1/10. Published 2026-09-01.
- How severe is CVE-2026-84201?
- High severity. CVSS v3 base score is 7.1 out of 10.