Appwrite Vulnerable to Cross-site Scripting

MEDIUM 5.4CVE-2022-2925 · GHSA-5ffj-mph5-c5hv · Published 09/09/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
appwrite/server-ce Packagist	`< 1.0.0-RC1`	`1.0.0-RC1`
appwrite appwrite	`≤ 0.15.3`	No fix yet

Description

Appwrite is vulnerable to stored cross-site scripting in usernames, function names, storage bucket names, and database collection names.

NVD description

Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.