Appwrite CVE-2026-89036

Requires an authenticated Appwrite account (version before 2.0.0) holding functions.write or sites.write permission - this is the primary limiting factor, not an admin-only privilege. The attacker must be able to submit a deployment whose providerRootDirectory parameter reaches the GNU tar command construction in the builds worker; injection succeeds because the code uses escapeshellcmd (which does not escape TAB argument separators) instead of escapeshellarg and does not quote the parameter. No user interaction and no non-default configuration toggle are required - the vulnerable build path is standard. Exploitation is bounded only by the need for the functions.write/sites.write capability and network reachability of the Appwrite instance.

This is a genuine high-priority issue, not a CVSS-inflated one. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 8.7) is internally consistent with the description: a network-reachable, low-complexity argument-injection flaw achieving full remote code execution as the builds worker process user. The only gating signal is PR:L - exploitation requires an authenticated account holding functions.write or sites.write, which meaningfully narrows the attacker pool but does not require admin/privileged roles, and in many Appwrite deployments project members or self-service developers hold exactly these permissions. The technical mechanism is well-understood and confirmed by source-code evidence: escapeshellcmd (which does not neutralize argument-splitting whitespace) is used instead of escapeshellarg, and the unquoted providerRootDirectory lets injected TAB characters spawn new GNU tar arguments such as --checkpoint-action=exec. No EPSS score, CISA KEV entry, or public POC was provided in the input, so this is best characterized as no public exploit identified at time of analysis - but the low technical barrier (a known tar-injection gadget) and VulnCheck's involvement make weaponization straightforward. Bottom line: real RCE, low complexity, authenticated-but-common privilege - patch promptly.

An attacker who has (or registers/obtains) an Appwrite account with functions.write or sites.write permission creates or updates a function/site deployment, setting the providerRootDirectory field to a value containing TAB characters followed by a malicious GNU tar flag such as --checkpoint=1 --checkpoint-action=exec=<command>. When the builds worker constructs and runs the tar command, escapeshellcmd fails to neutralize the TABs, tar interprets the injected flags, and arbitrary commands execute as the builds worker process user. No public POC was provided, but the --checkpoint-action=exec tar technique is a well-documented gadget.