Cross-site Scripting (XSS) - Stored in appwrite/appwrite

published 2022-09-09 4 y ago modified 2026-06-17 4 mo ago also GHSA-5ffj-mph5-c5hv , EUVD-2022-6708

cvss: 9.0; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 58%
public exploits: 0; none known

Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1.

Patch / fix

fixed in 2 links 1

packagist appwrite/server-ce 1.0.0-RC1
appwrite appwrite/appwrite 1.0.0-RC1

github.com/appwrite/appwrite@b5b4d92 commit

Exploit prediction

0.85% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

huntr.dev https://huntr.dev/bounties/a3b4148f-165f-4583-abed-5568696d99dc referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	9.0	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
GitHub	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	appwrite/server-ce	<1.0.0-RC1	1.0.0-RC1

Affected products

appwrite appwrite/appwrite

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /appwrite/appwrite/commit/b5b4d92623c13fa8e5c71736db461e81fb7a7ade
web, patch, third-party-advisory
huntr.dev /bounties/a3b4148f-165f-4583-abed-5568696d99dc
web, exploit, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2022-2925
advisory
drive.google.com /file/d/1JoMQy1KTodVtIVOzH3vKcC3AwZz0PrFb/view?usp=sharing
web
github.com /appwrite/appwrite
package

Sources

CVE List CVE-2022-2925
GitHub Advisory GHSA-5ffj-mph5-c5hv
NVD CVE-2022-2925

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary