Description
CVE-2026-30973 (GHSA-rfx7-4xw3-gh4m) was a plain path traversal in the entry name. The containment check built an Error object without throwing it, so an entry literally named something like ../evil.txt was written outside the destination. That issue was fixed in @appium/support 7.0.6 by actually rejecting out of bound entry names.
Recommendation
Update the @appium/support package to the latest compatible version. Followings are version details:
- Affected version(s): <= 7.2.5
- Patched version(s): 7.2.6
References
Could your website be exposed too?
SmartScanner can check your website for Appium: Symlink based Zip Slip in @appium/support ZIP extraction and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @appium/support has a Zip Slip arbitrary file write in its ZIP extraction - CVE-2026-30973
- DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE - CVE-2026-47669
- Decompress: Archive extraction can create files and links outside of the target directory - CVE-2026-53486
- @xhmikosr/decompress: Path traversal via symlink chain - CVE-2026-101894
You might also like:
See something that needs correcting? Let us knowUpdated October 15, 2026