CVE-2026-103975
Description
A flaw was found in Appium. This flaw allows an attacker to perform an arbitrary file write, potentially leading to arbitrary code execution, by providing a specially crafted ZIP archive. The issue occurs because the archive extraction utility accepts a symbolic link (a file shortcut pointing to another location) targeting a directory outside the intended extraction path and subsequently writes files through that link without verifying the destination. Consequently, an attacker can overwrite critical application files, configurations, or executables.
Statement
A moderate severity vulnerability was found in the ZIP extraction utility of the @appium/support npm package of Appium, an automation framework built on the W3C WebDriver protocol; no Red Hat products are currently recorded as affected by this flaw. The extractor applies only a lexical containment check to archive entry names and does not validate symbolic link targets. A crafted ZIP archive can first create a symbolic link pointing to a directory outside the extraction directory and then include a regular-file entry whose legitimate name resolves through that link, causing the file to be written outside the extraction root. When a user or automated pipeline extracts an attacker-supplied archive, this allows an attacker to create or overwrite files at any location writable by the Appium process, which can lead to arbitrary code execution if configuration files, startup scripts, or executables are overwritten. This vector is distinct from a previously fixed entry-name path traversal in the same code because it uses no parent-directory or absolute entry names, so name-based defenses accept every entry. The Red Hat and upstream severity assessments match (moderate, CVSS 3.1 score of 6.5).
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other
Technical Impact: Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
