CVE-2026-30973

Published: Mar 10, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Appium is an automation framework that provides WebDriver-based automation possibilities for a wide range platforms. Prior to 7.0.6, @appium/support contains a ZIP extraction implementation (extractAllTo() via ZipExtractor.extract()) with a path traversal (Zip Slip) check that is non-functional. The check at line 88 of packages/support/lib/zip.js creates an Error object but never throws it, allowing malicious ZIP entries with ../ path components to write files outside the intended destination directory. This affects all JS-based extractions (the default code path), not only those using the fileNamesEncoding option. This vulnerability is fixed in 7.0.6.

Affected (1)

Products: Appium: Appium/support

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Appium Appium/support	Before 7.0.6

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (3)

https://github.com/appium/appium/releases/tag/@appium/support@7.0.6

Source: security-advisories@github.com

Release Notes

https://github.com/appium/appium/security/advisories/GHSA-rfx7-4xw3-gh4m

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/appium/appium/security/advisories/GHSA-rfx7-4xw3-gh4m

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.