Appwrite

8 CVEs across 4 Appwrite products. Browse Appwrite vulnerabilities, severities, and proof-of-concept exploits.

Appwrite products with known CVEs

ProductCVEs
Appwrite6
Appwrite/appwrite1
Command Line Interface1
Templates1
Appwrite CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-89036High8.82026-09-17Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute a…
CVE-2026-72861Medium5.82026-08-20The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src…
CVE-2022-25377High7.52024-02-22The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. I…
CVE-2024-1063Medium5.32024-01-30Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159.
CVE-2023-50974Medium5.52024-01-09In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX…
CVE-2023-27159High7.52023-03-31Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers…
CVE-2022-2925Medium5.42022-09-09Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.
CVE-2021-23682High7.32022-02-16This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string…