Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103975— Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Quick assessment

Affected
appium appium
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Appium 是一个跨平台的自动化框架，适用于各种应用程序，其基于 W3C WebDriver 协议构建。在版本 7.2.6 之前，@appium/support 组件在处理 ZIP 文件解压时存在安全漏洞：攻击者可以构造一个包含指向提取目录外部位置的符号链接（symlink）的归档条目，随后再添加一个通过该符号链接解析为合法名称的普通文件条目。该组件在进行词汇性包含检查时，仅检查条目名称本身，而未验证符号链接的目标路径或实际解析后的目标路径，因此攻击者可以通过精心构造的 ZIP 文件，将任意文件写入 Appium

CVSS 6.5 · Medium EPSS 0.65% · P50

Affected Version Matrix 1

VendorProduct Version RangeStatus
appium appium < 7.2.6 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103975

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Appium: Symlink based Zip Slip in @appium/support ZIP extraction
Source: CVE Program / CVE List V5
Vulnerability Description
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later regular-file entry whose legitimate name resolves through that link. The lexical containment check examines entry names without validating the symlink target or the real destination, so an attacker-controlled archive can write files to arbitrary locations writable by the Appium process. This is distinct from the earlier parent-directory entry-name traversal fixed in 7.0.6 because the bypass uses no parent-directory or absolute entry name. Depending on the writable destination, the arbitrary file write can overwrite configuration, startup scripts, or executables and lead to code execution. This issue is fixed in version 7.2.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
appium appium < 7.2.6 -

II. Public POCs for CVE-2026-103975

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103975

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-103975 (2)

Other References for CVE-2026-103975 (2)

IV. Related Vulnerabilities

Same product: appium
Same vendor: appium
Same weakness: CWE-59

V. Comments for CVE-2026-103975

No comments yet

Leave a comment