VulnerableCode Package Details - pkg:composer/appwrite/server-ce@0.10.4

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:composer/appwrite/server-ce@0.10.4

Essentials
History (4)

purl	pkg:composer/appwrite/server-ce@0.10.4

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk	4.5

Vulnerabilities affecting this package (4)

Vulnerability	Summary	Fixed by
VCID-8aj4-prfj-gyfs Aliases: CVE-2021-23682 GHSA-v9p9-535w-4285	Prototype Pollution in litespeed.js and appwrite/server-ce	0.11.1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 0.12.2 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-eadh-6au3-sqfx Aliases: CVE-2022-2925 GHSA-5ffj-mph5-c5hv	Appwrite Vulnerable to Cross-site Scripting	1.0.0-RC1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 1.0.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-n1ja-akdw-6fep Aliases: CVE-2022-25377 GHSA-wfm3-gq9h-mrjm	The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (This pathname is automatically created if the user chooses to install Let's Encrypt certificates via Appwrite.)	0.12.2 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-n6ft-t627-yqd2 Aliases: CVE-2023-27159 GHSA-hxgx-584x-vwm8	Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.	There are no reported fixed by versions.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-12T19:21:14.110578+00:00	GitLab Importer	Affected by	VCID-n1ja-akdw-6fep	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/appwrite/server-ce/CVE-2022-25377.yml	38.6.0
2026-06-12T18:51:06.864841+00:00	GitLab Importer	Affected by	VCID-n6ft-t627-yqd2	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/appwrite/server-ce/CVE-2023-27159.yml	38.6.0
2026-06-12T18:31:17.863425+00:00	GitLab Importer	Affected by	VCID-eadh-6au3-sqfx	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/appwrite/server-ce/CVE-2022-2925.yml	38.6.0
2026-06-12T18:00:06.076240+00:00	GitLab Importer	Affected by	VCID-8aj4-prfj-gyfs	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/appwrite/server-ce/CVE-2021-23682.yml	38.6.0