Appium's support library contains a ZIP extraction routine that, before version 7.0.6, implements a non‑functional path‑traversal check. The routine creates an Error object when an entry includes a '../' component but never throws it, allowing the extraction to continue. An attacker can supply a malicious ZIP archive and cause the library to write arbitrary files outside the intended destination directory. That capability can lead to overwriting configuration or code files and potentially compromise application behavior or elevate privileges.

Any installation of @appium/support older than 7.0.6 is affected. All JavaScript‑based extraction paths in the library, not just those using the fileNamesEncoding option, are vulnerable. Projects that rely on Appium’s default ZIP extraction logic will be exposed.

The CVSS score of 6.5 classifies the vulnerability as moderate. The EPSS score is below 1 %, indicating a very low current exploitation probability, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a crafted ZIP file to the extraction routine, which may be possible through remote interfaces or when the library processes untrusted uploads. Successful exploitation would allow writing files outside the intended directory, potentially leading to privilege escalation if the process runs with elevated permissions.