CVE-2022-25377

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.)

• CWE-22

• https://dubell.io/unauthenticated-lfi-in-appwrite-0.5.0-0.12.1/Exploit
• https://github.com/appwrite/appwrite/blob/0.12.0/app/controllers/general.php#L539Product
• https://github.com/appwrite/appwrite/pull/2780Patch
• https://github.com/appwrite/appwrite/releases/tag/0.12.2Release Notes
• https://dubell.io/unauthenticated-lfi-in-appwrite-0.5.0-0.12.1/Exploit
• https://github.com/appwrite/appwrite/blob/0.12.0/app/controllers/general.php#L539Product
• https://github.com/appwrite/appwrite/pull/2780Patch
• https://github.com/appwrite/appwrite/releases/tag/0.12.2Release Notes

Published

Feb 22, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25370Apache OFBiz uses the Birt plugin (https://eclipse.github.io…5.4
• CVE-2022-25371Apache OFBiz uses the Birt project plugin (https://eclipse.g…9.8
• CVE-2022-25372Pritunl Client through 1.2.3019.52 on Windows allows local p…7.8
• CVE-2022-25373Zoho ManageEngine SupportCenter Plus before 11020 allows Sto…5.4
• CVE-2022-25374HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201…7.5
• CVE-2022-25375An issue was discovered in drivers/usb/gadget/function/rndis…5.5
• CVE-2022-2538The WP Hide & Security Enhancer WordPress plugin before 1.8 …6.1
• CVE-2022-25389DCN Firewall DCME-520 was discovered to contain an arbitrary…7.5
• CVE-2022-2539An issue has been discovered in GitLab CE/EE affecting all v…5.3
• CVE-2022-25390DCN Firewall DCME-520 was discovered to contain a remote com…9.8
• CVE-2022-25393Simple Bakery Shop Management v1.0 was discovered to contain…7.5
• CVE-2022-25394Medical Store Management System v1.0 was discovered to conta…9.8