CVE-2026-103975: Symlink Based Zip Slip Vulnerability in @appium/support
Summary
CVE-2026-103975: Appium: Symlink based Zip Slip in @appium/support ZIP extraction. Affects @appium/support versions < 7.2.6. Fixed in 7.2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @appium/support package is a critical component of the Appium framework, which is widely used for automating mobile applications. It provides various utilities and support functions necessary for the functioning of Appium. However, it has recently been identified as vulnerable to a symlink-based Zip Slip attack, which can lead to unauthorized file writes outside the intended extraction directory.
Vulnerability Detail
The vulnerability arises from the way the @appium/support package handles ZIP file extractions. Specifically, it allows for the creation of symbolic links that point outside the extraction directory. This occurs because the extractor only performs a lexical containment check on the entry names, without validating the symlink targets. As a result, an attacker can craft a ZIP file that, when extracted, writes files to arbitrary locations on the filesystem, potentially overwriting critical files or executing malicious scripts.
How To Fix
Latest published version: 7.2.8 as of 22 Oct 2026
npm install @appium/support@7.2.8Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.2.6
This is the first release that contains the fix.
npm install @appium/support@7.2.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid extracting ZIP files from untrusted sources or ensure that the extraction process is performed in a controlled environment where the Appium process does not have permission to write outside its intended directory.
Conclusion
The CVE-2026-103975 vulnerability in the @appium/support package poses a significant risk due to its potential for unauthorized file writes. It is crucial to update to the patched version 7.2.6 to mitigate this risk. Users should also be cautious when handling ZIP files from untrusted sources.
See every vulnerability recorded for @appium/support →
FAQ
CVE-2026-103975 is a vulnerability in the @appium/support package that allows for symlink-based Zip Slip attacks, enabling unauthorized file writes outside the extraction directory.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities without requiring any signup.
An attacker could exploit this vulnerability to write files to arbitrary locations, potentially overwriting configuration files, dropping malicious scripts, or replacing binaries, which could lead to code execution.
Yes, the vulnerability has been patched in version 7.2.6 of the @appium/support package. It is recommended to update to this version or later.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @appium/support.
