Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../ sequences and recursively delete arbitrary writable files or directories. This issue is fixed in version 1.1.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
#ALERT CVE-2026-58192 | CVSS 8.6 HIGH Appium storage plugin <1[.]1[.]6 allows unauthenticated path traversal via POST /storage/delete. Attackers can delete arbitrary files using ../ sequences. Update to 1[.]1[.]6 immediately. #CVE #Vulnerability #PatchNow https://t.co/CEXciAyos6
Post summary
CVE-2026-58192 exposes a CVSS 8.6 unauthenticated path traversal in the Appium storage plugin; users should update to version 1.1.6 immediately.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | appium | appium\/storage-plugin | - | node.js | - |