Appwrite 2.7.1 is a critical security release that updates the Open Runtimes executor to version 1.3.1 to mitigate a severe sandbox escape vulnerability. Teams hosting instances where untrusted users can deploy functions or sites must upgrade immediately and rotate their executor secrets.
Developers must be aware that compromised function execution environments could previously access internal executor secrets and API controls.
📊 Product & Engineering Leads
No direct new user-facing product capabilities are added, but maintaining platform security protects user trust and infrastructure stability.
⚙️ DevOps & Security
DevOps engineers must update their Open Runtimes executor image to 1.3.1 and follow instructions to rotate the _APP_EXECUTOR_SECRET environment variable if untrusted code was deployable.
⚡ Performance & Enhancements (2)
Added OPR_EXECUTOR_SECRET_PREVIOUS for zero-downtime executor secret rotation
Introduced an opt-in streamed response format in executor versions 1.2.x and 1.3.x
🔧 Bug Fixes & Patches (1)
Patched Open Runtimes executor vulnerability allowing symlink traversal and unauthorized access to environment secrets and host Docker control
📄 View Raw Release Notes (Original Developer Log)
Appwrite 2.7.1 is a security release that moves the Open Runtimes executor to 1.3.1. It ships with the same 1.2.138 self-hosted Console as 2.7.0, has no schema changes, and upgrading from 2.7.0 only replaces the images.
### Security
- Update the Open Runtimes executor from 1.1.2 to 1.3.1 (open-runtimes/executor#269, #15310). Executor 1.1.2 followed symlinks that a function or site plants in its execution log files, build logs, build output or build cache, and it used the runtime's log id without checking it. A function could read files from the executor container, including its environment with `_APP_EXECUTOR_SECRET`, as its own logs or build output. With that secret, code in a function can call the executor API directly, and the executor controls Docker on the host. **You are affected if anyone you don't fully trust can deploy functions or sites on your instance.** Upgrade, then rotate `_APP_EXECUTOR_SECRET` if that applies to you.
- Executor 1.2.x and 1.3.x also bring changes that keep existing behaviour: `OPR_EXECUTOR_SECRET_PREVIOUS` for rotating the executor secret without downtime, a storage DSN check that is off by default, and an opt-in streamed response format.
### Install
```bash
docker run -it --rm \
--volume /var/run/docker.sock:/var/run/docker.sock \
--volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
--entrypoint="install" \
appwrite/appwrite:2.7.1
```
### Upgrade
Upgrading from 2.7.0 uses the same command with `--entrypoint="upgrade"`, then run the migration, which has nothing to change for this release:
```bash
cd appwrite
docker compose exec appwrite migrate
```
If you maintain your own `docker-compose.yml`, set the `openruntimes-executor` image to `openruntimes/executor:1.3.1` and run `docker compose up -d`.
To rotate the executor secret, set a new `_APP_EXECUTOR_SECRET` in `.env` and run `docker compose up -d`. This recreates the API, the workers and the executor together, so nothing needs the old value.
**Back up your data first.**
### Contributors
Thank you to everyone who contributed to 2.7.1:
@loks0n
**Full Changelog**: https://github.com/appwrite/appwrite/compare/2.7.0...2.7.1