CVE-2026-58192 Details
Description
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../ sequences and recursively delete arbitrary writable files or directories. This issue is fixed in version 1.1.6.
A vulnerability in the Appium storage plugin prior to version 1.1.6 allows for unauthenticated arbitrary file and directory deletion. The issue arises because the plugin's 'POST /storage/delete' endpoint does not properly sanitize user-supplied 'name' values before processing. This lack of validation enables remote clients to manipulate the 'name' parameter to escape the designated storage root and recursively delete any writable files or directories on the host system.
Users can update to Appium storage plugin version 1.1.6, which addresses the vulnerability by adding proper sanitization for the 'delete' request.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/appium/appium/security/advisories/GHSA-jwgx-mp9m-jwcr | CISA-ADP | ExploitVendor Advisory |
| https://github.com/appium/appium/commit/5fee01752f2782e96fbe64fd13520b433d4a7535 | [email protected] | Patch |
| https://github.com/appium/appium/pull/22362 | [email protected] | Issue TrackingPatch |
| https://github.com/appium/appium/releases/tag/%40appium/storage-plugin%401.1.6 | [email protected] | Release Notes |
| https://github.com/appium/appium/security/advisories/GHSA-jwgx-mp9m-jwcr | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| appium appium/storage-plugin | < 1.1.6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 26, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |