CVE-2026-84201

Name of the Vulnerable Software and Affected Versions appium-mcp-server versions prior to 0.1.62

Description The software fails to validate or normalize file paths within the write file and write files batch tools. This allows attackers to use absolute paths or relative paths containing parent directory segments to write files outside the designated PROJECT ROOT directory. Consequently, arbitrary files, such as shell profiles and configuration files in the home directory, can be overwritten using the privileges of the server user.

Recommendations Update appium-mcp-server to version 0.1.62 or later. As a temporary mitigation, restrict the use of the write file and write files batch tools.