CVE-2026-58192 Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin
Unauthenticated attackers can delete arbitrary files or directories via path traversal in the Appium storage plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58192?
CVE-2026-58192 is a high-severity path traversal vulnerability in appium, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../ sequences and recursively delete arbitrary writable files or directories. This issue is fixed in version 1.1.6.
Which versions are affected by CVE-2026-58192?
It affects 1 product.
Products include Appium Appium\/Storage-Plugin.
How do I fix CVE-2026-58192?
No fix has been published for CVE-2026-58192 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-58192 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58192 exists.
Sources
Also known as GHSA-jwgx-mp9m-jwcr.