Catalog / Appwrite

1.9.9

yesterdaysecurityaddedfixedOriginal notes

Appwrite 1.9.9 is a precautionary maintenance release for self-hosted deployments on the 1.9 line. It moves the runtime to PHP 8.5.12. It retains Console 8.7.37 for compatibility with the 1.9 server APIs. Upgrading from 1.9.8 keeps the existing migration class and introduces no schema changes.

Highlights

  • Update PHP to 8.5.12. PHP 8.5.12 fixes CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell"). Appwrite is not affected by either one: it serves requests through Swoole rather than PHP's web SAPIs (mod_php, PHP-FPM, CGI). This release keeps the runtime on the patched version anyway.

Fixes

  • Runtime: update the base image to appwrite/base:1.4.5, which ships PHP 8.5.12 (appwrite/docker-base#126, #14747).

Under the hood

  • The new base image also includes the hardened ImageMagick resource policy from appwrite/base:1.4.4.
  • Map 1.9.9 to migration V25, the same class as 1.9.8; no migration class is added.

Removed

No environment variables, collections, or public APIs are removed.

Install

docker run -it --rm \
    --publish 20080:20080 \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
    --entrypoint="install" \
    appwrite/appwrite:1.9.9

Upgrade

Back up your database and persistent storage before upgrading. From the parent directory of an existing 1.9.8 installation, run:

docker run -it --rm \
    --publish 20080:20080 \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    --volume "$(pwd)"/appwrite:/usr/src/code/appwrite:rw \
    --entrypoint="upgrade" \
    appwrite/appwrite:1.9.9
cd appwrite
docker compose exec appwrite migrate

The patch reuses migration V25. No new configuration is required.

Full Changelog: https://github.com/appwrite/appwrite/compare/1.9.8...1.9.9