CVE-2026-30973: @appium/support Zip Slip Arbitrary File Write Vulnerability
Summary
CVE-2026-30973: @appium/support has a Zip Slip arbitrary file write in its ZIP extraction. Affects @appium/support versions < 7.0.6. Fixed in 7.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @appium/support package is a crucial component of the Appium framework, which is widely used for automating mobile applications. This package provides various utilities, including ZIP file extraction functionalities. However, it has been found to contain a vulnerability that allows for arbitrary file writes due to improper path traversal checks during ZIP extraction.
Vulnerability Detail
The vulnerability in @appium/support arises from a non-functional path traversal check in its ZIP extraction implementation. Specifically, the check creates an Error object without throwing it, allowing malicious ZIP entries with '..' path components to write files outside the intended destination directory. This can lead to arbitrary file writes, potentially allowing an attacker to overwrite critical files or create symlinks to arbitrary targets, which could escalate to remote code execution. The vulnerability affects all JS-based extractions and is classified as Medium severity with a CVSS score of 6.5.
How To Fix
Latest published version: 7.2.8 as of 22 Oct 2026
npm install @appium/support@7.2.8Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.6
This is the first release that contains the fix.
npm install @appium/support@7.0.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the vulnerable ZIP extraction functionality by enabling the system unzip fallback. This can be done by setting the option 'useSystemUnzip' to true when calling the extract function. However, this requires that the system unzip binary is available and functioning correctly.
Conclusion
The @appium/support package has a significant vulnerability that allows for arbitrary file writes due to improper path traversal checks in its ZIP extraction functionality. It is crucial for users to update to the patched version 7.0.6 to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for @appium/support →
FAQ
The vulnerability allows for arbitrary file writes due to a missing 'throw' statement in the path traversal check during ZIP extraction.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground.
An attacker could overwrite important files, create symlinks to arbitrary targets, or potentially execute arbitrary code by manipulating the file system.
Yes, a patch is available in version 7.0.6 of the @appium/support package. Updating to this version will resolve the vulnerability.
If immediate updates are not possible, consider using the system unzip fallback as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for @appium/support.
