CVE-2026-89036

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application...

CVE-2026-89036

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application...

EUVD-2026-81906

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application...

CVE-2026-89036 Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application...

CVE-2026-89036

Appwrite before 2.0.0 contains an argument injection vulnerability in the providerRootDirectory parameter used to construct GNU tar commands. The root cause is the use of escapeshellcmd instead of escapeshellarg without proper quoting, allowing TAB characters to survive sanitization and be interp...

CVE-2026-89036 Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application...

CVE-2026-89036 Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application...

CVE-2026-89036: Improper Neutralization of Argument Delimiters in a Command

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application...

PT-2026-94397

Name of the Vulnerable Software and Affected Versions Appwrite versions prior to 2.0.0 Description Authenticated users with functions.write or sites.write permissions can execute arbitrary commands. This occurs because the application uses escapeshellcmd instead of escapeshellarg and fails to quo...