CVE-2026-58192CWE-22CWE-73path-traversal

CVE-2026-58192

High · published July 9, 2026

CVSS v3.1
8.6
EPSS
1%
Percentile
49.8
In the wild
Unconfirmed
What it is

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../ sequences and recursively delete arbitrary writable files or directories. This issue is fixed in version 1.1.6.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00636 · 49.8th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-73 · External Control of File Name or Path
Published
2026-07-09T01:16Z
Affected products (1)
ProductVersionsFixed in
appium/appium\/storage-plugin< 1.1.61.1.6
References (5)
https://github.com/appium/appium/commit/5fee01752f2782e96fbe64fd13520b433d4a7535 · [email protected]https://github.com/appium/appium/pull/22362 · [email protected]https://github.com/appium/appium/releases/tag/%40appium/storage-plugin%401.1.6 · [email protected]https://github.com/appium/appium/security/advisories/GHSA-jwgx-mp9m-jwcr · [email protected]https://github.com/appium/appium/security/advisories/GHSA-jwgx-mp9m-jwcr · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 08 JUL 20:56Z
    Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin
    cvelistv5