Description

appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools, allowing attackers to write files outside the intended PROJECT_ROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite arbitrary files with the server user's privileges, including shell profiles and configuration files in the home directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-01T16:17:34.297Z",
  "pubdate": "2026-09-01T16:17:34.297Z",
  "executiveSummary": "The appium-mcp-server, in versions through 0.1.61, is susceptible to an arbitrary file write vulnerability caused by improper input validation of file paths.\nThis vulnerability exists within the write_file and write_files_batch tools, which fail to normalize or restrict user-supplied path strings.\nSuccessful exploitation allows an unauthenticated or authenticated attacker to write or overwrite arbitrary files on the underlying host filesystem.\nThe scope of this vulnerability is bounded by the privileges of the server process, enabling attackers to modify sensitive system configurations, shell profiles, or other critical files located outside of the designated PROJECT_ROOT directory.\nThe risk is critical, as it facilitates unauthorized modification of the host environment, potentially leading to full remote code execution or persistence if sensitive startup scripts are targeted.",
  "technicalDetails": "The vulnerability originates from a failure to implement robust path sanitization and boundary checks within the file-handling logic of the appium-mcp-server.\nSpecifically, the write_file and write_files_batch tools accept user-defined path parameters without adequately validating them against the expected PROJECT_ROOT directory.\nBecause the server does not normalize input paths or utilize chroot-like restrictions to contain file operations, an attacker can supply malicious path strings containing directory traversal sequences (e.g., ../) or absolute paths (e.g., /home/user/.bashrc).\nThe root cause is a lack of path resolution logic that verifies whether the canonicalized path remains within the intended sandbox boundary before performing file I/O operations.\nAttackers can leverage this by invoking the vulnerable tools with crafted payloads designed to escape the project directory.\nFor example, by requesting the creation of a file at /home/user/.ssh/authorized_keys or ~/.zshrc, an attacker can inject malicious content that will be executed or processed by the system or other users.\nSince the write operation is executed with the privileges of the server process, the impact is directly correlated with the user account running the server instance.\nIf the server is executed as a high-privileged user or the root user, the impact is severe, potentially allowing for system-wide compromise.\nThere are no requirements for authentication mentioned, implying that any entity capable of interacting with the vulnerable MCP tools can trigger the exploit.\nThe vulnerability effectively breaks the logical isolation of the application, transforming a file-writing feature into an unrestricted filesystem modification primitive.\nThe exploitation flow follows these steps: 1) The attacker identifies the exposed write_file or write_files_batch interface. 2) The attacker constructs a path parameter that traverses outside the permitted PROJECT_ROOT. 3) The attacker submits a payload containing the malicious file content. 4) The server processes the request and executes a write operation to the attacker-defined absolute or relative location.\nThe post-exploitation impact includes unauthorized configuration changes, service disruption, and the potential for privilege escalation through the modification of executable scripts or environment configuration files."
}