PatchTheCVE: appwritehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2022-25377: The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbhttps://patchthecve.com/cve/CVE-2022-25377.htmlhttps://patchthecve.com/cve/CVE-2022-25377.htmlWed, 17 Jun 2026 04:33:29 +0000HIGH 7.5: The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if CVE-2024-1063: Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpointhttps://patchthecve.com/cve/CVE-2024-1063.htmlhttps://patchthecve.com/cve/CVE-2024-1063.htmlWed, 17 Jun 2026 07:03:21 +0000MEDIUM 5.3: Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159. CVE-2023-50974: In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored inhttps://patchthecve.com/cve/CVE-2023-50974.htmlhttps://patchthecve.com/cve/CVE-2023-50974.htmlWed, 17 Jun 2026 06:40:20 +0000MEDIUM 5.5: In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials.