Appium: Symlink based Zip Slip in @appium/support ZIP extraction

{
  "id": "fb17ac5cbc5a5be51775411a3577061c1e8ce6fbf226e30c0ba7a019709887c5",
  "url": "https://osv.dev/vulnerability/GHSA-qfxx-c367-67f8",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Appium: Symlink based Zip Slip in @appium/support ZIP extraction",
    "summary": "### Summary CVE-2026-30973 [(GHSA-rfx7-4xw3-gh4m)](https://github.com/appium/appium/security/advisories/GHSA-rfx7-4xw3-gh4m) was a plain path traversal in the entry name. The containment check built an Error object without throwing it, so an entry literally named something like `../evil.txt` was written outside the destination. That issue was fixed in @appium/support 7.0.6 by actually rejecting out of bound entry names. This finding is a different vector that the 7.0.6 fix does not cover. The archive entry names here are completely legitimate (for example `pwn` and `pwn/owned.txt`, no `..` anywhere), so every name based defense accepts them. The escape happens through a symbolic link. One entry is a symlink whose target points outside the extraction directory, and a later entry is a regular file whose name resolves through that symlink. The name based containment check never inspects the symlink target, and the extractor writes the symlink target verbatim, so the file lands outside the extraction root. The two issues compared on the same patched version 7.2.5: | | CVE-2026-30973 | This finding | |---|---|---| | Vector | one entry whose name contains `..` | a symlink entry plus a file written through it | | Entry names | contain `..` (illegal) | legitimate, no `..` and not absolute | | What is missing | the `..` name chec\\k did not throw | name checks never resolve symlinks, and the symlink target is unchecked | | Entries needed | one | two | | Fixed in 7.0.6 | yes | no | | St",
    "evidence": "osv:GHSA-qfxx-c367-67f8",
    "products": [
      {
        "name": {
          "value": "@appium/support",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "7.2.6",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "GHSA-qfxx-c367-67f8",
      "aliases": [
        "CVE-2026-103975",
        "GHSA-qfxx-c367-67f8"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "7.2.6"
                }
              ]
            }
          ],
          "package": {
            "name": "@appium/support",
            "purl": "pkg:npm/%40appium/support",
            "ecosystem": "npm"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-qfxx-c367-67f8/GHSA-qfxx-c367-67f8.json",
            "last_known_affected_version_range": "<= 7.2.5"
          }
        }
      ],
      "modified": "2026-10-15T20:30:05.447884211Z",
      "provider": "osv",
      "references": [
        "https://github.com/appium/appium/security/advisories/GHSA-qfxx-c367-67f8",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-103975",
        "https://github.com/appium/appium/pull/22436",
        "https://github.com/appium/appium/commit/d9eb36f413153e28b04b92d8ce4447da270371c0",
        "https://github.com/appium/appium",
        "https://github.com/appium/appium/releases/tag/@appium/support@7.2.6"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-59"
        ],
        "severity": "MODERATE",
        "github_reviewed": true,
        "nvd_published_at": "2026-10-14T18:17:21Z",
        "github_reviewed_at": "2026-10-15T20:18:56Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-103975",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 336045,
  "published_at": "2026-10-15T20:18:56+00:00"
}