Appium’s ZIP extraction routine in @appium/support allowed a malicious archive to create a symbolic link that points outside the extraction directory. The extractor checks only the filenames, not the real target of the symlink. An attacker can then include a separate file whose name resolves through the symlink, causing the file to be written to an arbitrary location writable by the Appium process. This arbitrary file write can overwrite configuration files, startup scripts, or executables, providing a path to code execution.

The vulnerability exists in the Appium automation framework, specifically in the @appium/support package version 7.2.5 and earlier. Any instance of Appium running with that package is affected; the fix is delivered in version 7.2.6.

The CVSS score of 6.5 identifies it as a moderate severity flaw. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting lower but still present threat. The exploit requires delivering a crafted ZIP archive to the Appium process, which is likely to receive such archives during normal test‑case execution. If successful, the attacker can write to any file path that is writable by Appium, which in many cases includes directories where configuration or executable files reside, thereby enabling code execution.