AIKIDO-2026-852587
node-appwrite is vulnerable to Path Traversal
59
Medium Risk
This Affects:
node-appwriteTL;DR
The Appwrite Node.js SDK builds REST endpoint paths by substituting caller-supplied identifiers directly into URL templates. Before the fix these identifiers were inserted without URL-encoding, so values containing reserved characters such as slashes or .. segments changed the structure of the resulting request path. An application that forwards untrusted or unvalidated identifiers into SDK service methods could therefore have its requests redirected to unintended API paths or resources. The fix wraps path parameters in encodeURIComponent before substituting them into the endpoint path.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application passes untrusted or unvalidated identifiers into SDK method calls.
Background info
node-appwrite is vulnerable to Path Traversal in versions 1.0.0 - 26.2.0.
How to fix this
Upgrade the node-appwrite library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant