Appwrite - vulnerabilities (CVEs)

9 CVEs in 4 products, 1 in the last 30 days, newest from 2026-10-11.

Products

• Appwrite - 7 CVEs
• Appwriteappwrite - 1 CVEs
• Command Line Interface - 1 CVEs
• Templates - 1 CVEs

Newest CVEs of Appwrite

• CVE-2026-108770 - CVSS 6.9 (medium), 2026-10-11: A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file…
• CVE-2026-89036 - CVSS 8.8 (high), 2026-09-17: Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute…
• CVE-2026-72861 - CVSS 6.9 (medium), 2026-08-20: The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in…
• CVE-2022-25377 - CVSS 7.5 (high), 2024-02-22: The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal.…
• CVE-2024-1063 - CVSS 7.5 (high), 2024-01-30: Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159.
• CVE-2023-50974 - CVSS 5.5 (medium), 2024-01-09: In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX…
• CVE-2023-27159 - CVSS 7.5 (high), 2023-03-31: Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows…
• CVE-2022-2925 - CVSS 9 (critical), 2022-09-09: Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.
• CVE-2021-23682 - CVSS 9.8 (critical), 2022-02-16: This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query…