CVE-2026-58192

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../ sequences and recursively delete arbitrary writable files or directories. This issue is fixed in version 1.1.6.

• CWE-22
• CWE-73

• https://github.com/appium/appium/commit/5fee01752f2782e96fbe64fd13520b433d4a7535Patch
• https://github.com/appium/appium/pull/22362Issue Tracking, Patch
• https://github.com/appium/appium/releases/tag/%40appium/storage-plugin%401.1.6Release Notes
• https://github.com/appium/appium/security/advisories/GHSA-jwgx-mp9m-jwcrExploit, Vendor Advisory
• https://github.com/appium/appium/security/advisories/GHSA-jwgx-mp9m-jwcrExploit, Vendor Advisory

Published

Jul 8, 2026

Last Modified

Aug 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58185The Apache Traffic Server intercept plugin has a use-after-f…9.8
• CVE-2026-58186The Apache Traffic Server webp_transform plugin can decode u…8.2
• CVE-2026-58187The Apache Traffic Server multiplexer plugin overruns its ch…7.5
• CVE-2026-58188Several Apache Traffic Server experimental plugins have memo…8.4
• CVE-2026-58189Apache Traffic Server allows redirect-limit bypass when plug…8.2
• CVE-2026-58191Appium is a cross-platform automation framework for all kind…6.1
• CVE-2026-58195Agentic-Flow is an AI agent orchestration platform. Prior to…8.8
• CVE-2026-58196ToolHive is a utility designed to simplify the deployment an…4.7
• CVE-2026-58197ToolHive is a utility designed to simplify the deployment an…8.8
• CVE-2026-58198ChatterBot is a machine learning, conversational dialog engi…5.5
• CVE-2026-5820The Zypento Blocks plugin for WordPress is vulnerable to Sto…6.4
• CVE-2026-58200Payload Plugins is a collection of plugins designed to enhan…7.1