CVE-2026-103975

Executive Summary

CVE-2026-103975 is a symlink-based ZIP extraction vulnerability in @appium/support versions prior to 7.2.6, affecting the Appium cross-platform automation framework. An attacker who supplies a crafted archive can create a symbolic link pointing outside the extraction directory and subsequently write files to arbitrary locations writable by the Appium process. Because the flaw enables arbitrary file writes that can overwrite configuration, startup scripts, or executables, successful exploitation can lead to code execution under the privileges of the Appium service.

Technical Analysis

Appium is a cross-platform automation framework built on the W3C WebDriver protocol, and the @appium/support package provides ancillary utilities — among them ZIP archive extraction. In versions prior to 7.2.6, the extraction routine performs a lexical containment check on archive entry names: it verifies that each entry name does not contain parent-directory (..) segments or absolute paths, thereby resolving to a location that appears to be inside the extraction directory.

The vulnerability (CWE-59: Improper Link Resolution Before File Access) arises because the lexical check examines only the entry name and does not validate the symlink target or the real, resolved destination on disk. A crafted archive can therefore contain:

1. A first entry that creates a symbolic link whose target points to a directory outside the extraction root (for example, /etc, a user startup directory, or a service configuration directory writable by the Appium process).
2. A second, later entry with a legitimate-looking name that contains no .. or absolute path components, but whose path resolves through the previously created symlink.

Because the second entry's name passes the lexical containment check, the extraction routine follows the link and writes the file to the symlink's target location rather than to a location inside the extraction directory. The result is an arbitrary file write constrained only by the filesystem permissions of the account running the Appium process.

The NVD description explicitly notes that this is distinct from an earlier parent-directory entry-name traversal issue remediated in 7.0.6. The 7.0.6 fix addressed entry names containing .. traversal; the present bypass uses no parent-directory or absolute entry name at all, which is precisely why the prior lexical mitigation is insufficient. The correction requires resolving symlinks and validating the actual destination (a realpath-style canonicalization and containment check) before writing extracted content.

Weaknesses in the trusted extraction boundary mean that any component, pipeline, or integration that automatically unpacks attacker-supplied archives is a potential attack surface. The NVD description does not enumerate specific calling functions, APIs, or endpoints inside @appium/support; no further implementation-level detail is available from the supplied data.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-103975; the attack chain below is inferred from the documented vulnerability class and mechanism in the NVD description.

1. Reconnaissance and target identification. The attacker identifies a target environment in which Appium (using @appium/support < 7.2.6) automatically extracts archives supplied by a less-trusted party. Candidate delivery paths include CI/CD pipelines that unpack uploaded build artifacts, test harnesses that ingest user-submitted test bundles, or any automated workflow that treats an archive as input and extracts it without sandboxing.

2. Triggering the flaw class. The attacker constructs a ZIP archive containing (a) an entry that is a symbolic link whose target is outside the intended extraction directory, and (b) a subsequent regular-file entry whose name is lexically "clean" — containing no .. segment and no absolute path — but whose path resolves through the symlink created in step (a). The archive is delivered to the Appium process through whatever interface accepts archives (file upload, artifact retrieval, test bundle submission).

3. Execution method (vulnerability-class level). The extraction routine's lexical containment check accepts both entries. The first entry creates the out-of-tree symlink; the second entry is written through that link, placing attacker-controlled file content at an arbitrary path writable by the Appium process. No parent-directory or absolute entry name is used, bypassing the 7.0.6 entry-name traversal mitigation.

4. Post-exploitation impact. Depending on the destination the process can write to, the attacker can overwrite configuration files, startup scripts, or executables. Overwriting an executable or a startup script that is later executed (directly or on service restart) can yield code execution with the privileges of the Appium process. The CVSS 3.1 vector reflects network-reachable attack (AV:N), no privileges required (PR:N), and user interaction required (UI:R) — consistent with a victim being induced to process a malicious archive — with high integrity impact (I:H), no confidentiality impact (C:N), and no availability impact (A:N), scope unchanged (S:U).

Impact Assessment

CVE-2026-103975 has a CVSS 3.1 base score of 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N.

• AV:N / AC:L / PR:N: The attack is reachable over the network with low complexity and no prior privileges; the barrier is delivering the crafted archive to an extraction flow.
• UI:R: Exploitation requires that the Appium process (or an operator driving it) process the malicious archive, consistent with a social-engineering or supply-chain delivery component.
• I:H: Integrity impact is high — arbitrary file writes can corrupt or replace configuration, startup scripts, or executables.
• C:N / A:N: The vector models no confidentiality or availability impact for this CVE.
• S:U: Impact remains within the security scope of the vulnerable component.

Business impact. Environments that automate Appium-based testing and automatically extract archives from external or lower-trust sources are most exposed. The blast radius is bounded by the filesystem permissions of the Appium process: the more privileged that process (for example, a CI runner or a service account with broad write access), the more severe the potential arbitrary-write and subsequent code-execution impact. Integrity loss of configuration or startup scripts can also produce persistent, hard-to-detect modification of the automation environment.

Detection Guidance

Sigma Rule

title: Suspicious Archive Extraction Creating Out-of-Tree Symlinks (Appium @appium/support CVE-2026-103975)
id: 9f3c1a72-4b8e-4d2a-9c7e-appium103975
status: experimental
description: Detects archive extraction processes creating symbolic links followed by file writes outside the extraction directory, consistent with CVE-2026-103975 symlink ZIP extraction bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103975
author: valtersit.com
logsource:
  category: process_creation
  product: linux
detection:
  selection_extract:
    Image|endswith:
      - '/unzip'
      - '/tar'
      - '/node'
    CommandLine|contains:
      - 'unzip'
      - 'extract'
      - 'Appium'
  selection_symlink:
    CommandLine|contains:
      - 'ln -s'
  condition: selection_extract and selection_symlink
falsepositives:
  - Legitimate build tooling that creates symlinks during artifact staging
level: medium
tags:
  - attack.t1195
  - cve.2026-103975

YARA Rule

rule CVE_2026_103975_Appium_Symlink_Zip
{
    meta:
        description = "Detects ZIP archives carrying out-of-tree symlink entries indicative of CVE-2026-103975 in @appium/support"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103975"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $zip_magic = { 50 4B 03 04 }
        $symlink_mode = { 41 FF }   // external attrs high bytes for symlink (0xA1FF)
        $parent_trav = "../"
        $abs_path = ":/"

    condition:
        $zip_magic at 0 and
        #symlink_mode > 0 and
        filesize < 10MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103975 Appium @appium/support Symlink ZIP Extraction Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"PK"; depth:2; content:"Appium"; nocase; threshold:type limit, track by_src, count 1, seconds 60; reference:cve,2026-103975; classtype:attempted-user; sid:2026103975; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("unzip", "tar", "node", "appium") and
  process.command_line : ("*unzip*" or "*extract*" or "*Appium*") and
  process.command_line : "*ln -s*"

Splunk SPL Query

index=main (process_name=unzip OR process_name=tar OR process_name=node OR process_name=appium)
(process=*extract* OR CommandLine=*Appium*)
| search CommandLine="*symlink*" OR CommandLine="*ln -s*" OR CommandLine="*PK*"
| stats count min(_time) as firstTime max(_time) as lastTime by host, user, process_name, CommandLine
| where count > 0

Wazuh OSSEC Rule

<group name="appium,cve-2026-103975,">
  <rule id="100975" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">unzip|tar|node|appium</field>
    <field name="process.command_line">\.\./|symlink|ln -s</field>
    <description>CVE-2026-103975: Possible Appium @appium/support symlink ZIP extraction bypass detected</description>
    <mitre>
      <id>T1195</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in version 7.2.6, but no patch, commit, or advisory was confirmed by any tracked source at report time. Treat all environments as exposed until the upgrade is independently verified.

1. Immediate mitigations

   • Upgrade @appium/support to 7.2.6 or later. This is the only remediation identified in the NVD description.
   • Where upgrade is not immediately possible, do not feed untrusted archives into Appium-driven extraction flows. Quarantine, inspect, and pre-validate all archives before extraction.
   • Run the Appium process with least privilege and confine its write access to a dedicated, non-sensitive directory to reduce the impact of arbitrary writes.
   • Extract archives in an isolated container or sandbox with a read-only or ephemeral filesystem and no access to startup scripts, configuration stores, or executables.
   • Validate archives with tooling that resolves symlink targets and rejects entries whose canonical destination falls outside the extraction root before extraction occurs.

2. Patch/upgrade steps

   • Update the @appium/support dependency (direct or transitive) to >= 7.2.6.
   • Rebuild and redeploy dependent Appium components so the fixed extraction logic is in effect.
   • Verify the installed version using your package manager and confirm no older copies remain in dependency trees (npm ls @appium/support).

3. Long-term hardening

   • Adopt canonical-path (realpath) validation and containment checks — not lexical string checks alone — for all archive extraction utilities across your stack.
   • Enforce a policy of never auto-extracting archives from untrusted or external sources inside privileged automation pipelines.
   • Track @appium/support and Appium advisories through your SCA/vulnerability-management program; archive-extraction libraries are recurrently affected by symlink and traversal classes (CWE-59, CWE-22).

References

• NVD — CVE-2026-103975: https://nvd.nist.gov/vuln/detail/CVE-2026-103975
• CWE-59: Improper Link Resolution Before File Access ('Link Following'): https://cwe.mitre.org/data/definitions/59.html
• Appium project documentation and @appium/support package: https://appium.io/
• W3C WebDriver protocol specification: https://www.w3.org/TR/webdriver/
• CISA Known Exploited Vulnerabilities catalog (verify status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or exploit-in-the-wild evidence was identified for CVE-2026-103975 at time of writing. The EPSS score has not yet been assigned by FIRST.org. The vulnerability is not listed in CISA KEV.