CVE-2026-89036: Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter
Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application uses escapeshellcmd instead of escapeshellarg and fails to quote the parameter, allowing TAB characters to survive sanitization and be interpreted as argument separators, enabling injection of arbitrary GNU tar arguments such as --checkpoint-action=exec to achieve remote code execution as the builds worker process user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
appwriteto a version that resolves this vulnerability.Fixed in 2.0.0 - Configuration
Update Appwrite to a version that fixes the argument injection in the providerRootDirectory parameter used to construct GNU tar commands (the issue affects versions before 2.0.0).
Appwrite providerRootDirectory handling Quote providerRootDirectory argument before constructing GNU tar command (use proper shell escaping so TAB characters cannot survive) = Use proper quoting/argument escaping (e.g., escapeshellarg) instead of escapeshellcmd and ensure providerRootDirectory is quoted
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user must have either functions.write or sites.write permission. Exploitation results in command execution as the builds worker process user.
What input is required for exploitation?
The attacker needs to supply TAB characters in the providerRootDirectory parameter. Those characters can be interpreted as argument separators in the GNU tar command, allowing injected tar arguments such as --checkpoint-action=exec.
Are Appwrite 2.0.0 installations affected?
The issue affects Appwrite versions before 2.0.0. The provided release and commit references identify 2.0.0 as the fixed release.