CVE-2026-58192

Name of the Vulnerable Software and Affected Versions Appium versions prior to 1.1.6

Description The Appium storage plugin contains a flaw where the handler for the 'POST /storage/delete' endpoint passes the user-supplied name variable directly into path.join(storageRoot, name) and the fs.rimraf() function without proper path sanitization. This allows an unauthenticated remote client to use directory traversal sequences (../) to escape the storage root and recursively delete arbitrary writable files or directories.

Recommendations Update to version 1.1.6.