CVE-2026-58192: Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../ sequences and recursively delete arbitrary writable files or directories. This issue is fixed in version 1.1.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Appium (storage plugin)to a version that resolves this vulnerability.Fixed in 1.1.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58192?
CVE-2026-58192 has a high severity rating of 8.6.
How do I fix CVE-2026-58192?
To fix CVE-2026-58192, update the Appium storage plugin to version 1.1.6 or later.
What systems are affected by CVE-2026-58192?
CVE-2026-58192 affects versions of the Appium storage plugin prior to 1.1.6.
What type of vulnerability is CVE-2026-58192?
CVE-2026-58192 is classified as a path traversal vulnerability.
What potential impact does CVE-2026-58192 have?
CVE-2026-58192 allows unauthenticated arbitrary file or directory deletion, posing a significant risk to affected systems.