CVE-2024-1063 is a Medium severity server side request forgery, scored 5.3, in Appwrite through the /v1/avatars/favicon endpoint. It bypasses the incomplete fix for CVE-2023-27159. Tenable says upgrade to Appwrite 1.5.0 or later. The record lists versions up to 1.4.13 as affected.
What's affected
The record says Appwrite up to and including 1.4.13 is affected. Tenable's advisory TRA-2024-03 says versions prior to 1.5.0 are affected and that 1.5.0 is the fixed release. These agree, since 1.5.0 is the first release after 1.4.13 in that line.
Both give a base score of 5.3, Medium. Tenable's temporal score is 5.0, and the vector shows a network attack with no login and low confidentiality impact only.
How to check if you're exposed
If you run Appwrite in Docker, read the version from the running containers.
docker ps --format '{{.Names}} {{.Image}}' | grep -i appwrite
The image tag shows the version. Anything before 1.5.0 is affected. In the Appwrite console the version also appears on the settings page. If you embed Appwrite SDKs only, note that the issue is in the server, not the client libraries.
What to do now
- Find every self hosted Appwrite instance and its version.
- Upgrade to 1.5.0 or later. Tenable lists no workaround.
- Limit outbound network access from the Appwrite host so that it cannot reach internal services or cloud metadata addresses it does not need.
- Review logs for favicon requests that point at internal addresses.
- Check that the earlier CVE-2023-27159 fix is not your only protection, since this CVE bypassed it.
Why it matters
The class is server side request forgery, CWE-918: the server is tricked into making a request to a destination the caller picked. On cloud hosts the interesting targets are internal services and metadata endpoints that trust requests from the server itself.
This CVE exists because an earlier fix for CVE-2023-27159 was incomplete. That is a common pattern. A blocklist for bad destinations is hard to get right, so egress limits on the host are a useful second layer. The record's KEV flag is false. Tenable credits its researcher and notes it tried to reach the vendor several times between December 2023 and January 2024.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Appwrite version fixes this?
Tenable says 1.5.0 or later. The record lists up to 1.4.13 as affected.
Is there a workaround?
The advisory lists none. Limiting outbound traffic from the host is a sensible extra step, not a vendor fix.
Sources
Last reviewed: 19 October 2026.
