Executive brief
Appium is an automation framework used for testing mobile and desktop applications. A security flaw in its storage plugin allows an unauthenticated person to remotely delete any file or folder that the software has permission to access on the host computer. This could lead to the permanent loss of critical data, source code, or system configuration files, potentially disrupting development operations or disabling the server.
Technical details
The Appium storage plugin (prior to version 1.1.6) contains a path traversal vulnerability in its POST /storage/delete endpoint. The handler for this endpoint accepts a user-supplied 'name' parameter and passes it directly to path.join() and fs.rimraf() without sanitization. An unauthenticated remote attacker can use '../' sequences to escape the intended storage directory and recursively delete any file or directory writable by the Appium process. This occurs because the delete path lacks the fs.sanitizeName validation implemented in the plugin's upload path. The issue is resolved in @appium/storage-plugin version 1.1.6.
Affected products
- Appium @appium/storage-plugin < 1.1.6
Timeline
- 2026-06-07: other: Fix proposed in pull request
- 2026-06-18: patched: Version 1.1.6 released
- 2026-06-30: advisory: GitHub Security Advisory published
- 2026-07-08: disclosed: CVE published to NVD