Appwrite

This hub aggregates every CVE we track for Appwrite, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 6 most recently published vulnerabilities affecting Appwrite.

• CVE-2022-25377The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_...7.5Feb 22, 2024
• CVE-2024-1063Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159. 5.3Jan 30, 2024
• CVE-2023-50974In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local sys...5.5Jan 9, 2024
• CVE-2023-27159Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensi...7.5Mar 31, 2023
• CVE-2022-2925Cross-site Scripting (XSS) - Stored in appwrite/appwrite5.4Sep 9, 2022
• CVE-2021-23682Prototype Pollution7.3Feb 16, 2022