CVE-2026-89036: 
Appwrite Platform Análisis y mitigación de vulnerabilidades

CVE-2026-89036 is an argument injection vulnerability in Appwrite, an open-source backend-as-a-service platform, affecting all versions before 2.0.0. Authenticated users holding functions.write or sites.write permissions can inject TAB characters into the providerRootDirectory parameter to execute arbitrary commands via GNU tar argument injection, ultimately achieving remote code execution (RCE) as the builds worker process user. The vulnerability was published on September 17, 2026, and is classified as High severity with a CVSS v3.1 base score of 8.8 and a CVSS v4.0 base score of 8.7 (Feedly, VulnCheck Advisory).

The root cause is CWE-88 (Improper Neutralization of Argument Delimiters in a Command — Argument Injection). Appwrite's builds worker uses escapeshellcmd instead of escapeshellarg to sanitize the providerRootDirectory parameter, and critically fails to quote the parameter when constructing GNU tar command strings. TAB characters survive the escapeshellcmd sanitization and are interpreted by the shell as argument separators, allowing an attacker to inject arbitrary GNU tar flags — most notably --checkpoint-action=exec=<command> — which causes tar to execute attacker-controlled commands during archive processing. Exploitation requires only low-privilege authenticated access (a valid account with functions.write or sites.write permissions) and no user interaction, making it straightforward to trigger over the network (Feedly, VulnCheck Advisory).

Successful exploitation grants an attacker arbitrary command execution as the builds worker process user, resulting in full compromise of confidentiality, integrity, and availability on the affected host. An attacker could exfiltrate sensitive build artifacts, source code, environment variables, and secrets accessible to the worker process, modify or destroy build outputs, or use the compromised worker as a pivot point for lateral movement within the Appwrite infrastructure. The technical impact is rated "total" by NVD's SSVC assessment (Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment notes exploitation as "none" and automatable as "no." The EPSS score is approximately 0.0127 (1.27%), indicating a low but non-negligible probability of exploitation in the near term. No threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify an Appwrite instance running a version prior to 2.0.0. Confirm the target is reachable over the network and obtain or create an account with functions.write or sites.write permissions.
2. Authenticate: Log in to the Appwrite instance and obtain a valid API key or session token with the required write permissions.
3. Craft malicious payload: Prepare a providerRootDirectory value containing TAB characters followed by injected GNU tar arguments, for example: legitimate_dir\t--checkpoint=1\t--checkpoint-action=exec=<malicious_command> (where \t represents a literal TAB character).
4. Submit the payload: Send an API request to create or update a function/site deployment, supplying the crafted providerRootDirectory value. The Appwrite builds worker will incorporate this unsanitized value into a GNU tar command string.
5. Trigger command execution: When the builds worker processes the deployment and invokes tar, the injected --checkpoint-action=exec argument causes tar to execute the attacker-specified command as the worker process user, achieving RCE (Feedly, VulnCheck Advisory).

• Logs: Build worker logs showing tar invocations with unexpected arguments such as --checkpoint, --checkpoint-action, or --to-command; error messages or unexpected output from tar commands in build logs.
• Process: Unusual child processes spawned by the Appwrite builds worker (e.g., sh, bash, curl, wget, python, nc) that are not part of normal build operations.
• Network: Unexpected outbound connections from the builds worker container/host to external IP addresses, particularly on non-standard ports, which may indicate reverse shell or data exfiltration activity.
• File System: Unexpected files written to the build workspace or worker filesystem, including scripts, binaries, or web shells not associated with legitimate deployments; new cron jobs or scheduled tasks created under the worker process account.

The primary remediation is to upgrade Appwrite to version 2.0.0 or later, which removes the vulnerable executor build backend code path entirely (the providerRootDirectory parameter handling via the old executor is deleted in favor of the jobs-service orchestrator) (Appwrite Releases, GitHub PR #13028). As interim mitigations, restrict functions.write and sites.write permissions exclusively to trusted administrators, implement network segmentation to limit access to the Appwrite instance, and monitor build worker logs for suspicious tar command executions. There is no known configuration-only workaround that fully eliminates the vulnerability without upgrading.

The vulnerability was disclosed by VulnCheck and assigned via their disclosure program (VulnCheck Advisory). No significant public researcher commentary, vendor statements beyond the patch, or notable media coverage has been identified at this time.