CVE-2026-30973 Details
Description
Appium is an automation framework that provides WebDriver-based automation possibilities for a wide range platforms. Prior to 7.0.6, @appium/support contains a ZIP extraction implementation (extractAllTo() via ZipExtractor.extract()) with a path traversal (Zip Slip) check that is non-functional. The check at line 88 of packages/support/lib/zip.js creates an Error object but never throws it, allowing malicious ZIP entries with ../ path components to write files outside the intended destination directory. This affects all JS-based extractions (the default code path), not only those using the fileNamesEncoding option. This vulnerability is fixed in 7.0.6.
A path traversal vulnerability, known as Zip Slip, has been identified in the @appium/support package of Appium, affecting versions through 7.0.5. The issue arises in the ZIP extraction method 'extractAllTo()', which uses the 'ZipExtractor.extract()' function. The vulnerability exists because the path traversal check intended to prevent malicious ZIP entries from writing files outside the designated directory is ineffective. Although the check creates an Error object, it fails to throw the error, allowing exploitation. This issue impacts all JavaScript-based extractions by default, not just those with the 'fileNamesEncoding' option enabled.
Users can upgrade to @appium/support version 7.0.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/appium/appium/security/advisories/GHSA-rfx7-4xw3-gh4m | CISA-ADP | ExploitVendor Advisory |
| https://github.com/appium/appium/releases/tag/@appium/[email protected] | [email protected] | Release Notes |
| https://github.com/appium/appium/security/advisories/GHSA-rfx7-4xw3-gh4m | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| appium appium/support | < 7.0.6 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | Initial Analysis | [email protected] |
| Mar 12, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | New CVE Received | [email protected] |