External risk intelligence

Appium Storage Plugin Path Traversal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-58192

Appium is a framework used primarily by developers for automation and testing of applications. It is typically deployed within isolated local, CI/CD, or internal development environments rather than being exposed as a public-facing internet service.

Path Traversal

Appium\/storage Plugin

before 1.1.6

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the Appium storage plugin that could allow remote attackers to delete arbitrary files and directories. This framework is used for application automation and testing. The primary concern is to confirm if this technology is in use and exposed externally.

Appium plugin allows remote file deletion.
Confirms if Appium is in use and exposed.
Assess Appium relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can remotely access the Appium storage plugin without authentication. By sending a crafted request to the `/storage/delete` endpoint, an attacker can manipulate file paths to write to arbitrary locations and delete files or directories. This could lead to unauthorized modification or deletion of sensitive data.

No authentication required.
Triggered by crafted POST request to delete endpoint.
Risk of arbitrary file deletion.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated remote attacker could exploit a vulnerability in the Appium storage plugin to recursively delete arbitrary writable files or directories outside of the intended storage root. This could occur when the plugin is used in environments where the storage plugin's endpoint is accessible over the network and an attacker can control the `name` parameter passed to the delete function. The risk of sensitive information disclosure or PII compromise is not directly indicated by the advisory.- Arbitrary files can be deleted.

Unauthenticated remote client can delete files.
System data integrity may be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for application development and the underlying infrastructure or platform supporting it should address this vulnerability. The initial step is to locate all instances of the affected Appium storage plugin, confirm their exposure and criticality, identify the responsible application or system owner, and then prioritize remediation efforts.

Application and platform teams own this.
Verify plugin exposure and business criticality.
Plan remediation during scheduled maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Appium storage plugin?

Appium is an automation framework developers use to test mobile and web applications across different platforms. The storage plugin is a component that manages file storage during these testing processes, allowing the framework to save, retrieve, or remove data as part of automated workflows.

What does CWE-22 mean for CVE-2026-58192?

CWE-22 is a weakness known as path traversal. In this vulnerability, the plugin fails to sanitize user input before using it to locate files. Because of this, an attacker can use special character sequences—specifically '..'—to navigate outside the intended storage folder and instruct the system to interact with files elsewhere on the machine.

How is this vulnerability triggered?

The issue is triggered when an unauthenticated remote user sends a specifically crafted POST request to the plugin's /storage/delete endpoint. This vulnerability does not trigger if the request uses a standard, sanitized filename or if the attacker lacks the ability to influence the path parameter passed to the delete function.

Is my environment at risk from this Appium vulnerability?

According to Halo Surface Signal, Appium is typically used in isolated development or CI/CD environments, making public internet exposure of this endpoint very unlikely. You are at higher risk if your specific deployment has mistakenly exposed this plugin to an untrusted network, rather than keeping it restricted to an internal or local testing segment.

What steps should I take to address CVE-2026-58192?

Your first step is to identify all systems where the Appium storage plugin is installed. Once located, verify the version in use; if it is older than 1.1.6, plan to update the plugin immediately. Coordinate with your development or infrastructure teams to ensure that any instance of the plugin is appropriately secured and not accessible to unauthorized network traffic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.