EUVD-2026-69288
GHSA-j4m2-645j-49qh
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector matches Appium MCP server deployment; no privileges needed to call write_file; no user interaction required for direct tool invocation; confidentiality unaffected.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools, allowing attackers to write files outside the intended PROJECT_ROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite arbitrary files with the server user's privileges, including shell profiles and configuration files in the home directory.
AnalysisAI
Path traversal in appium-mcp-server through 0.1.61 allows any caller of the write_file or write_files_batch MCP tools to overwrite arbitrary files on the host system by supplying absolute paths or parent-directory sequences (../) that escape the intended PROJECT_ROOT boundary. The server user's full filesystem write permissions are exposed, enabling an attacker to corrupt shell profiles, inject cron jobs, or overwrite application configuration files. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have the ability to call the write_file or write_files_batch MCP tools on the running server - this encompasses direct MCP protocol access or indirect access via an LLM agent that processes attacker-controlled input (prompt injection). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) rates this 6.9 (Medium), reflecting local-only access and passive user interaction - likely modeling an LLM-mediated attack where a user triggers the file write through routine AI interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been confirmed at time of analysis - the VulnCheck advisory (https://www.vulncheck.com/advisories/appium-mcp-server-through-0.1.61-path-traversal-in-write-file-and-write-files-batch) and referenced source code identify the vulnerable code but do not reference a fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today