PT-2026-24342 · Appium+1 · Appium+1

Bugbunny-Research · Published 2026-03-10 · Updated 2026-05-07 · CVE-2026-30973

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Appium versions prior to 7.0.6

Description Appium, an automation framework, has an issue in its ZIP extraction implementation within the @appium/support package. The path traversal check (Zip Slip) in extractAllTo() via ZipExtractor.extract() is non-functional because an Error object is created but not thrown. This allows malicious ZIP files containing ../ path components to write files outside the intended destination directory. This impacts all JavaScript-based extractions, which is the default code path. The vulnerable code is located at line 88 of packages/support/lib/zip.js. The vulnerable function is ZipExtractor.extract(). The vulnerable parameter is the ZIP file itself.

Recommendations Update to Appium version 7.0.6 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-30973

GHSA-RFX7-4XW3-GH4M

Affected Products

@Appium/Support

Appium

References · 9

• 🔥 https://github.com/appium/appium/security/advisories/GHSA-rfx7-4xw3-gh4m · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30973.json · Exploit
• https://osv.dev/vulnerability/GHSA-rfx7-4xw3-gh4m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30973 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30973 · Security Note
• https://github.com/appium/appium · Note
• https://github.com/appium/appium/releases/tag/@appium/support@7.0.6 · Note
• https://twitter.com/CVEnew/status/2033361101396619425 · Twitter Post
• https://t.me/cveNotify/162633 · Telegram Post