Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-58192— Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin

CVSS 8.6 · High EPSS 0.34% · P27

Affected Version Matrix 1

VendorProductVersion RangeStatus
appiumappium< 1.1.6affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-58192

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin
Source: CVE Program / CVE List V5
Vulnerability Description
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../ sequences and recursively delete arbitrary writable files or directories. This issue is fixed in version 1.1.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Appium 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
appium是Appium团队开源的一个跨平台应用自动化测试框架。 Appium 1.1.6之前版本存在安全漏洞，该漏洞源于存储插件在路径处理中未对用户提供的name值进行路径清理，直接传入path.join(storageRoot, name)和fs.rimraf()，可能导致未经身份验证的远程客户端利用../序列逃逸存储根目录，递归删除任意可写文件或目录。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
appiumappium < 1.1.6 -

II. Public POCs for CVE-2026-58192

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium
Qwen3.6-35B-A3B · 7674 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-58192

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-58192 (2)

Vendor Advisories for CVE-2026-58192 (1)

Vendor Pages for CVE-2026-58192 (1)

IV. Related Vulnerabilities

Same product: appium
Same vendor: appium
Same weakness: CWE-22

V. Comments for CVE-2026-58192

No comments yet

Leave a comment