CVE-2026-103975 appium CVE debrief

Who should care

Defenders responsible for systems using @appium/support for ZIP extraction should assess exposure and prioritize verification and remediation efforts. This includes developers and security teams working with @appium/support in npm environments.

Why it matters

CVE-2026-103975 is a Zip Slip vulnerability in @appium/support that allows for unauthorized file writes via symbolic links in ZIP archives. Defenders should prioritize verifying inventory, upgrading to version 7.2.6 or later, and implementing compensating controls. Evidence is limited, and details on exploitation or business impact are not provided.

• Potential unauthorized file writes outside extraction directories
• Possible data integrity issues due to malicious ZIP archives
• Need for verification of @appium/support version and exposure
• Prioritization of remediation efforts for affected systems

Technical summary

The @appium/support package is vulnerable to a Zip Slip attack due to improper handling of symbolic links in ZIP archives. An attacker could exploit this by crafting a ZIP file with a symlink that targets outside the extraction directory, allowing for unauthorized file writes. The vulnerability arises from the package's failure to properly validate the targets of symbolic links within ZIP archives, enabling an attacker to write files outside the intended extraction directory. This could lead to potential security issues, including data integrity problems and unauthorized access.

Defensive priority

Defenders should prioritize verifying inventory and upgrading to @appium/support version 7.2.6 or later. Systems using @appium/support for ZIP extraction should assess exposure and implement compensating controls, such as monitoring for suspicious file writes.

Recommended defensive actions

• Verify @appium/support version and upgrade to 7.2.6 or later
• Monitor for suspicious file writes outside extraction directories
• Implement compensating controls for ZIP extraction processes
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was discovered in @appium/support and reported via GitHub advisory GHSA-qfxx-c367-67f8. Official CVE and NVD records provide additional context. However, details on exploitation, victims, or business impact are not provided in the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.