CVE-2026-58192: Appium Storage Plugin Path Traversal – Arbitrary File Deletion

Technical summary

The POST /storage/delete endpoint in the Appium storage plugin fails to sanitize the user-supplied 'name' parameter before passing it to path.join(storageRoot, name) and fs.rimraf(). This allows path traversal sequences to escape the intended storage root directory. An attacker can craft requests with payloads like '../../sensitive/path' to reach and recursively delete files outside the storage root, affecting any directory writable by the Appium process. The vulnerability stems from insufficient input validation on directory/file names, a classic path traversal flaw (CWE-22) combined with improper handling of special elements in file names (CWE-73).

Business impact

Organizations relying on Appium for automation testing infrastructure face risk of operational disruption through unexpected file deletion. If Appium runs with elevated privileges or in environments where it can access configuration files, credentials, test data, or application binaries, attackers could sabotage testing pipelines, destroy evidence, or compromise CI/CD workflows. The unauthenticated nature of the attack means any network-reachable Appium instance—whether intentionally exposed or misplaced on a development network—becomes an attack surface. Recovery from malicious deletion could require data restoration, testing delays, and incident investigation.

Affected systems

All Appium versions prior to 1.1.6 are vulnerable. The storage plugin must be enabled or present for the endpoint to be exploitable. Any deployment where the Appium server is network-accessible without authentication—common in development, staging, or containerized environments—is at risk. Verify your Appium version by checking the package version number or running 'appium --version'.

Exploitability

This vulnerability is straightforward to exploit: it requires only network access to the Appium server and knowledge of the /storage/delete endpoint. No authentication is needed, no user interaction is required, and no complex conditions must be met. The attack vector is network-based with low complexity. Any attacker with the ability to reach the Appium port can immediately attempt directory traversal payloads. The CVSS score of 8.6 (HIGH) reflects the combination of unauthenticated remote access, lack of user interaction, and integrity impact (file deletion) across the broader system (not just the application).

Remediation

Upgrade Appium to version 1.1.6 or later immediately. If immediate patching is not feasible, restrict network access to the Appium server through firewall rules or network segmentation—limit access to only trusted internal networks and specific IP ranges. Disable or remove the storage plugin if it is not needed. Run Appium with the least privileges necessary; avoid running it as root or with administrative permissions. Monitor for suspicious POST requests to the /storage/delete endpoint during the remediation window.

Patch guidance

Update to Appium 1.1.6 or any subsequent version. Consult the official Appium project repository or release notes to confirm availability and compatibility with your testing infrastructure. Patch testing environments first, then production automation systems. Verify after patching that the /storage/delete endpoint is no longer accepting path traversal sequences by testing with a simple '../../test' payload—it should fail or be rejected.

Detection guidance

Log and monitor POST requests to /storage/delete for suspicious patterns: payloads containing ../ or ..\, excessively long path names, or requests targeting directories outside the intended storage root. Look for error messages in Appium logs indicating failed file operations or unexpected deletions. Network-level detection should flag POST requests to Appium's port from unexpected sources. Review access logs for repeated or automated attack attempts. If forensic analysis is needed, check filesystem logs or system audit trails for unexpected deletion of files during the vulnerability window.

Why prioritize this

This vulnerability should be prioritized as HIGH due to its unauthenticated remote exploitability, straightforward attack vector, and potential for significant integrity impact. The ability to delete arbitrary files without authentication makes this especially dangerous in CI/CD and testing environments where Appium controls critical infrastructure. Organizations with public-facing or network-exposed Appium instances should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 8.6 reflects: Attack Vector Network (AV:N) – the flaw is exploitable over the network; Attack Complexity Low (AC:L) – no special conditions or timing required; Privileges Required None (PR:N) – no authentication needed; User Interaction None (UI:N) – the attacker acts alone; Scope Changed (S:C) – the impact extends beyond the Appium application itself to the underlying system; Confidentiality None (C:N) – no data disclosure; Integrity High (I:H) – arbitrary file deletion is possible; Availability None (A:N) – availability is not directly impacted by the vulnerability itself, though deleted files may disrupt services. The HIGH severity reflects a critical authorization and input validation failure with system-wide impact.

Frequently asked questions