CVE-2026-58192 is a high severity flaw (CVSS 8.6) in the Appium storage plugin before 1.1.6. The POST /storage/delete handler does not sanitize the name value, so an unauthenticated client can delete files outside the storage root. Upgrade to version 1.1.6.
What's affected
- @appium/storage-plugin before 1.1.6.
- Fixed version: 1.1.6.
How to check if you're exposed
Run appium plugin list --installed to see installed plugins and versions, or npm ls -g @appium/storage-plugin for a global install. Check CI images and device lab hosts too, since Appium servers often live there.
To find this library in your own projects, paste a manifest or lockfile into the free in-browser dependency scan at gold.safeguard.sh/scan. Gold lists known CVEs for the packages it finds, and its reachability analysis helps you separate code that actually calls a vulnerable function from code that only ships it.
What to do now
- Update the storage plugin to 1.1.6 through your usual package process.
- Do not expose Appium servers to untrusted networks.
- Run Appium as a user that cannot write to sensitive paths.
- Pin the plugin version in your CI image.
Once the new version is in, run the same dependency or version check again and keep the output with your change record. Lockfiles drift, and a rebuilt image can quietly pull the old version back in, so check the artifact you actually deploy and not only the source tree.
Why it matters
This is CWE-22 (Path Traversal) with CWE-73 (External Control of File Name or Path). The handler passes the user supplied name directly into a path join and a recursive delete without checking for parent directory sequences. The fix adds name sanitizing to the delete request, as the upstream commit says.
The CISA KEV flag is false. Test servers are easy to forget, and they often run with wide file permissions.
Appium servers speak the WebDriver protocol and are usually trusted by whoever can reach them, since the protocol was built for test automation and not for hostile networks. A delete endpoint with no path checks makes that trust costly: files outside the plugin storage folder could be removed, including configuration and test assets.
The fix is small. The upstream pull request adds name sanitizing for the delete request, matching what the upload path already had. The project release for the storage plugin is 1.1.6. Because it is a plugin, you can update it without changing the Appium core version, though you should read the release notes before doing so on a shared lab.
Try it yourself
A pull request gate can stop a vulnerable plugin version before it reaches your test infrastructure.
Click through it at your own pace, or open it full screen.
Quick check
Is login required?
No. The record says an unauthenticated remote client can reach the endpoint.
Sources
Last reviewed: 19 October 2026.
