CVE-2026-58192

Description

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../ sequences and recursively delete arbitrary writable files or directories. This issue is fixed in version 1.1.6.

PUBLISHED Reserved 2026-06-29 | Published 2026-07-08 | Updated 2026-07-09 | Assigner GitHub_M

Problem types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-73: External Control of File Name or Path

Product status

References

github.com/...appium/security/advisories/GHSA-jwgx-mp9m-jwcr exploit

github.com/...appium/security/advisories/GHSA-jwgx-mp9m-jwcr

github.com/appium/appium/pull/22362

github.com/...ommit/5fee01752f2782e96fbe64fd13520b433d4a7535

github.com/...pium/releases/tag/@appium/storage-plugin@1.1.6

cve.org (CVE-2026-58192)

nvd.nist.gov (CVE-2026-58192)

Download JSON