Description
@appium/support contains a ZIP extraction implementation (extractAllTo() via ZipExtractor.extract()) with a path traversal (Zip Slip) check that is non-functional. The check at line 88 of packages/support/lib/zip.js creates an Error object but never throws it, allowing malicious ZIP entries with ../ path components to write files outside the intended destination directory.
Recommendation
Update the @appium/support package to the latest compatible version. Followings are version details:
- Affected version(s): <= 7.0.5
- Patched version(s): 7.0.6
References
Could your website be exposed too?
SmartScanner can check your website for @appium/support has a Zip Slip arbitrary file write in its ZIP extraction and gives you actionable findings to investigate.
Start a free scanRelated Issues
- DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE - CVE-2026-47669
- SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory - CVE-2026-34522
- Rollup 4 has Arbitrary File Write via Path Traversal - CVE-2026-27606
- Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163
You might also like:
See something that needs correcting? Let us knowUpdated March 11, 2026