CVE-2023-27159

HighCVSS 7.5

Published: 31/03/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

36.17%

98th percentile - higher than 98% of all known CVEs

Summary

Appwrite up to version 1.2.1 was found to contain a Server-Side Request Forgery (SSRF) vulnerability in the /v1/avatars/favicon component. This allows attackers to access network resources and sensitive information via a crafted GET request.

Risk Assessment

The risk involves unauthorized access to internal network resources and potential leakage of sensitive data, which could lead to further attacks on the organization's infrastructure.

Recommendation

It is recommended to immediately upgrade Appwrite to version 1.2.2 or later, which includes a fix for the SSRF vulnerability. Additionally, consider restricting access to the /v1/avatars/favicon component using firewall rules.

Original NVD description (English source)

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.