CVE-2026-30973: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30973 is a Zip Slip (path traversal) vulnerability in the @appium/support npm package, a core utility library for the Appium automation framework. The flaw exists in the ZIP extraction implementation (extractAllTo() via ZipExtractor.extract()) where a path traversal guard creates an Error object but never throws it, rendering the protection entirely non-functional. All versions of @appium/support up to and including 7.0.5 are affected; the vulnerability was disclosed on March 9, 2026, and fixed in version 7.0.6. IBM DevOps Test UI (Rational Functional Tester) is also affected as a downstream consumer. The CVSS v3.1 base score is 6.5 (Medium) (Github Advisory, IBM Advisory).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In packages/support/lib/zip.js at line 88, the traversal check uses new Error(...) as a bare expression instead of throw new Error(...), making it a no-op — the surrounding try/catch block and error message strongly suggest the throw keyword was accidentally omitted. As a result, await this.extractEntry(entry) executes unconditionally even when a ../ path component is detected. The extractEntry method then writes to the attacker-controlled path via fs.createWriteStream(dest) or fs.symlink(link, dest) with no additional validation. A second unprotected sink, _extractEntryTo() (line 263), also lacks any traversal check. The upstream yauzl library provides no path traversal protection regardless of the decodeStrings setting, meaning the vulnerability affects all JS-based extractions by default — not only those using the fileNamesEncoding option (Github Advisory).

Successful exploitation allows an attacker to write arbitrary files to any location writable by the Appium process, outside the intended extraction directory. Malicious ZIP entries with symlink attributes can additionally create symlinks pointing to arbitrary targets, enabling further attacks on subsequent file operations. By overwriting scripts, configuration files, node_modules contents, cron jobs, or shell profiles, an arbitrary file write can chain into remote code execution on the host running Appium. There is no direct confidentiality or availability impact, but the high-integrity impact creates a significant path to full system compromise (Github Advisory).

A public proof-of-concept (PoC) is available in the official Appium security advisory, consisting of a complete bash/Python/Node.js script that creates a malicious ZIP with a ../pwned.txt traversal entry and demonstrates arbitrary file write outside the destination directory (Github Advisory). Exploitation requires no authentication and no special privileges, but does require user interaction — a user or automation system must initiate extraction of the attacker-supplied archive. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.042–0.067%, placing it in the 21st percentile for exploitation probability (Github Advisory).

1. Craft a malicious ZIP: Use Python's zipfile module to create a ZIP archive (evil.zip) containing an entry with a path traversal component, e.g., ../pwned.txt or ../../etc/cron.d/backdoor, with attacker-controlled content:

import zipfile, os
with zipfile.ZipFile('evil.zip', 'w') as z:
    z.writestr('../pwned.txt', 'ZIPSLIP_MARKER')

2. Deliver the malicious ZIP: Supply the crafted archive to a target system running a vulnerable version of @appium/support (≤ 7.0.5). This can be done by hosting the ZIP at a URL that Appium or an automation pipeline fetches as an app package, or by providing it directly to any code path that calls extractAllTo().
3. Trigger extraction: Cause the target system to invoke extractAllTo(zipPath, destDir, { useSystemUnzip: false }) on the malicious archive. This is the default code path; no special options are required.
4. Observe arbitrary file write: Because the traversal check at line 88 of zip.js never throws, extractEntry() proceeds unconditionally, writing the file to the resolved path outside destDir (e.g., one directory level up).
5. Chain to code execution (optional): Overwrite a high-value target such as a Node.js script in node_modules, a cron job, a shell profile (.bashrc, .profile), or an Appium configuration file to achieve remote code execution when the written file is subsequently loaded or executed (Github Advisory).

• File System: Unexpected files appearing outside the intended ZIP extraction directory (e.g., one or more directory levels above the dest folder); newly created or modified files in sensitive locations such as node_modules/, cron directories (/etc/cron.d/, /var/spool/cron/), shell profiles (~/.bashrc, ~/.profile), or Appium configuration paths that correspond to the Appium process user.
• File System: Unexpected symlinks created in or near the extraction destination directory pointing to arbitrary targets outside the intended scope.
• Logs: Application or Appium server logs showing ZIP extraction operations initiated from untrusted or external sources; absence of expected Out of bound path error messages during extraction of archives that contain ../ path components (since the error is never thrown in vulnerable versions).
• Process: Unexpected child processes spawned by the Appium Node.js process following a ZIP extraction event, particularly shells (/bin/bash, sh) or network utilities (curl, wget) if an overwritten script is executed.

The primary remediation is to upgrade @appium/support to version 7.0.6 or later, which adds the missing throw keyword to the traversal check in ZipExtractor.extract() and also adds a traversal check to the previously unprotected _extractEntryTo() function (Appium Release). IBM has also released a patch for affected DevOps Test UI / Rational Functional Tester products (IBM Advisory). As an interim workaround where upgrading is not immediately possible: validate ZIP file contents before extraction to reject entries containing ../ path components, restrict ZIP extraction operations to archives from trusted sources only, and consider enabling useSystemUnzip: true (noting that this falls back to the vulnerable JS path if the system unzip binary fails). Implementing additional file path validation at the application level provides defense-in-depth.

The vulnerability was discovered and reported by bugbunny.ai and disclosed via the official Appium GitHub Security Advisory on March 9, 2026 (Github Advisory). No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time.