https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 15:21:31 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-84201 <p>appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools, allowing attackers to write files outside the intended PROJECT_ROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite arbitrary files with the server user&#39;s privileges, including shell profiles and configuration files in the home directory.</p> <p>appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools, allowing attackers to write files outside the intended PROJECT_ROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite arbitrary files with the server user&#39;s privileges, including shell profiles and configuration files in the home directory.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-84201 https://vulnerability.circl.lu/vuln/ghsa-j4m2-645j-49qh <p>appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools, allowing attackers to write files outside the intended PROJECT_ROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite arbitrary files with the server user&#39;s privileges, including shell profiles and configuration files in the home directory.</p> <p>appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools, allowing attackers to write files outside the intended PROJECT_ROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite arbitrary files with the server user&#39;s privileges, including shell profiles and configuration files in the home directory.</p> https://vulnerability.circl.lu/vuln/ghsa-j4m2-645j-49qh