6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30973

CVE-2026-30973: Zip Slip arbitrary file write in @appium/support ZIP extraction

Appium is an automation framework that provides WebDriver-based automation possibilities for a wide range platforms. Prior to 7.0.6, @appium/support contains a ZIP extraction implementation (extractAllTo() via ZipExtractor.extract()) with a path traversal (Zip Slip) check that is non-functional. The check at line 88 of packages/support/lib/zip.js creates an Error object but never throws it, allowing malicious ZIP entries with ../ path components to write files outside the intended destination directory. This affects all JS-based extractions (the default code path), not only those using the fileNamesEncoding option. This vulnerability is fixed in 7.0.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30973

CVE-2026-30973:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@appium/support	npm	<= 7.0.5	7.0.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Zip Slip issue within the @appium/support package, allowing an attacker to write arbitrary files by crafting a malicious ZIP archive with path traversal sequences (../). The root cause is twofold:

In the primary extraction workflow initiated by extractAllTo, the ZipExtractor.extract method had a path traversal check that was rendered non-functional because it created an Error object without throwing it. This allowed the extraction to proceed even when a malicious path was detected.
A secondary function, _extractEntryTo (used by readEntries), lacked any path traversal validation whatsoever, creating another vector for the same vulnerability.

The vulnerable call chain starts with the user calling extractAllTo. This function instantiates ZipExtractor and calls its extract method. Inside extract, the defective check fails, and it proceeds to call extractEntry, which acts as the sink, writing the file to the malicious path. The patches in version 7.0.6 fixed both issues by adding the missing throw in ZipExtractor.extract and implementing a proper path validation check in _extractEntryTo.

Vulnerable functions

ZipExtractor.extract

packages/support/lib/zip.js

This method contains the primary vulnerability, a path traversal check that creates an Error object but fails to throw it. This allows a malicious ZIP entry with '..' in its path to bypass the check, leading to an arbitrary file write (Zip Slip). The fix in commit 98d2497b490103bfee929120eb884aca57234562 adds the missing 'throw' keyword.

_extractEntryTo

packages/support/lib/zip.ts

This function, used by the `readEntries` export, was also vulnerable to path traversal. It resolved the destination path using `path.resolve(destDir, entry.fileName)` without any validation to ensure the path was within the intended destination directory. An attacker could craft a ZIP file with an entry like '../../pwned.txt' to write a file outside the extraction directory. The vulnerability was fixed in commit eee4c05844f9ac9bab1e1f1e36a20f81d1cd837f by adding a check using `isSubPath`.

extractAllTo

packages/support/lib/zip.js

This is the main public-facing API function that triggers the vulnerable code path. It takes a ZIP file path and a destination directory, creates a `ZipExtractor` instance, and calls the vulnerable `extract()` method, making it the entry point for the exploit.

ZipExtractor.extractEntry

packages/support/lib/zip.js

This method is the sink for the vulnerability in `ZipExtractor.extract`. After the flawed check in `extract()` is bypassed, this method is called to perform the actual file extraction. It constructs the malicious file path and uses `fs.createWriteStream` to write the file to an arbitrary location on the filesystem, as controlled by the attacker.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.