Secuno
ENNL
Book demo

CVE-2026-89036

8.8 HIGH
  1. Published17 Sept 2026

Description

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application uses escapeshellcmd instead of escapeshellarg and fails to quote the parameter, allowing TAB characters to survive sanitization and be interpreted as argument separators, enabling injection of arbitrary GNU tar arguments such as --checkpoint-action=exec to achieve remote code execution as the builds worker process user.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-868648.8
pgAdmin 4's Backup tool appended the client-supplied 'database' field from the…
CVE-2026-768628.8
Netcore NR255-V version 1.5.130703 contains an os command argument injection…
CVE-2026-543379.8
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an…
CVE-2026-877948.4
bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the…
CVE-2026-713779.8
Command Argument Injection Vulnerability in Cosminexus Component Container. This issue…
CVE-2026-860609.8
RouterOS contains an argument-handling flaw in the SSH login path involving usernames…

Frequently asked

Is CVE-2026-89036 being actively exploited?

CVE-2026-89036 is not in the CISA KEV catalog.

How severe is CVE-2026-89036?

CVE-2026-89036 has a CVSS 3.1 base score of 8.8, rated high.

How do I fix CVE-2026-89036?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-89036 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.