GHSA-QFXX-C367-67F8 Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Summary CVE-2026-30973 GHSA-rfx7-4xw3-gh4m was a plain path traversal in the entry name. The containment check built an Error object without throwing it, so an entry literally named something like ../evil.txt was written outside the destination. That issue was fixed in @appium/support 7.0.6 by...

EUVD-2026-101529

Appium: Symlink based Zip Slip in @appium/support ZIP extraction...

@appium/base-driver (>=10.3.0, <=10.7.1), @appium/base-plugin (>=3.2.0, <=3.3.2) +19 more potentially affected by CVE-2026-103975 via @appium/support (>=7.1.0, <=7.2.5)

@appium/support NPM version =7.1.0, =10.3.0, =3.2.0, =2.3.0, =6.0.4, =4.2.0, =4.2.0, =1.1.0, =4.1.0, =2.1.4, =3.0.10, =1.0.0, =1.0.0, =2.107.37, =2.107.37, =2.136.0 - @silakagent/android-runner 0.1.0 and more Source cves: CVE-2026-103975 Source advisory: OSV:GHSA-QFXX-C367-67F8...

@appium/base-driver (>=10.3.0, <=10.7.1), @appium/base-plugin (>=3.2.0, <=3.3.2) +19 more potentially affected by CVE-2026-103975 +1 more via @appium/support (>=7.1.0, <=7.2.5)

@appium/support NPM version =7.1.0, =10.3.0, =3.2.0, =2.3.0, =6.0.4, =4.2.0, =4.2.0, =1.1.0, =4.1.0, =2.1.4, =3.0.10, =1.0.0, =1.0.0, =2.107.37, =2.107.37, =2.136.0 - @silakagent/android-runner 0.1.0 and more Source cves: CVE-2026-103975, CVE-2026-30973 Source advisory: GHSA-QFXX-C367-67F8...

Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Summary CVE-2026-30973 GHSA-rfx7-4xw3-gh4m was a plain path traversal in the entry name. The containment check built an Error object without throwing it, so an entry literally named something like ../evil.txt was written outside the destination. That issue was fixed in @appium/support 7.0.6 by...

CVE-2026-103975

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

CVE-2026-103975 Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

CVE-2026-103975 Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

CVE-2026-103975

The @appium/support component in Appium (prior to version 7.2.6 ) is vulnerable to an arbitrary file write via a symlink-based ZIP Slip . The root cause is that the ZIP extraction process fails to validate the symlink target or the real destination during a lexical containment check. An attacker-...

@appium/base-driver (>=10.5.0, <=10.7.1), @appium/base-plugin (>=3.2.2, <=3.3.2) +15 more potentially affected by CVE-2026-103975 via @appium/support (>=7.2.0, <=7.2.5)

@appium/support NPM version =7.2.0, =10.5.0, =3.2.2, =2.4.0, =6.0.4, =4.2.2, =4.2.2, =1.1.2, =4.1.2, =2.1.4, =3.0.10, =1.0.0, =1.0.0, =3.4.0, =0.1.0-beta.1, =0.1.0-beta.15 and more Source cves: CVE-2026-103975 Source advisory: MEND:CVE-2026-103975...

CVE-2026-103975 Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

PT-2026-113963

Name of the Vulnerable Software and Affected Versions Appium versions prior to 7.2.6 Description ZIP extraction in @appium/support allows an archive entry to create a symbolic link to a location outside the extraction directory. A subsequent regular-file entry can then resolve through this link...

CVE-2026-103975: Improper Link Resolution Before File Access

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the @appium/support package

Summary Due to the use of the @appium/support package, DevOps Test Performance and Rational Performance Tester contain a potential path traversal vulnerability CVE-2026-30973, Vulnerability Details CVEID:CVE-2026-30973 DESCRIPTION: Appium is an automation framework that provides WebDriver-based...

GHSA-RFX7-4XW3-GH4M @appium/support has a Zip Slip arbitrary file write in its ZIP extraction

Summary @appium/support contains a ZIP extraction implementation extractAllTo via ZipExtractor.extract with a path traversal Zip Slip check that is non-functional. The check at line 88 of packages/support/lib/zip.js creates an Error object but never throws it, allowing malicious ZIP entries with...

@appium/support has a Zip Slip arbitrary file write in its ZIP extraction

Summary @appium/support contains a ZIP extraction implementation extractAllTo via ZipExtractor.extract with a path traversal Zip Slip check that is non-functional. The check at line 88 of packages/support/lib/zip.js creates an Error object but never throws it, allowing malicious ZIP entries with...

EUVD-2026-10709

@appium/support has a Zip Slip arbitrary file write in its ZIP extraction...

Directory Traversal

Overview @appium/support is a Support libs used across Appium packages Affected versions of this package are vulnerable to Directory Traversal in the extractAllTo function. An attacker can write arbitrary files outside the intended extraction directory by supplying a crafted ZIP archive containin...

CVE-2026-30973 Zip Slip arbitrary file write in @appium/support ZIP extraction

Appium is an automation framework that provides WebDriver-based automation possibilities for a wide range platforms. Prior to 7.0.6, @appium/support contains a ZIP extraction implementation extractAllTo via ZipExtractor.extract with a path traversal Zip Slip check that is non-functional. The chec...

CVE-2026-30973 Zip Slip arbitrary file write in @appium/support ZIP extraction

Appium is an automation framework that provides WebDriver-based automation possibilities for a wide range platforms. Prior to 7.0.6, @appium/support contains a ZIP extraction implementation extractAllTo via ZipExtractor.extract with a path traversal Zip Slip check that is non-functional. The chec...