Loading story…
A high-severity vulnerability tracked as CVE-2026-58192 affects @appium/storage-plugin versions prior to 1.1.6, allowing an unauthenticated remote client to delete arbitrary writable files or directories through the plugin’s POST /storage/delete handler. The issue stems from a path traversal weakness in which attacker-controlled input is passed into path.join(storageRoot, name) and then into fs.rimraf() without sufficient sanitization, enabling ../ sequences to escape the intended storage root and trigger recursive deletion.
Appium addressed the flaw in @appium/storage-plugin 1.1.6, where the project added fs.sanitizeName handling for delete requests. The vulnerability has been classified under CWE-22 and CWE-73 and assigned the CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N, reflecting remote exploitation with no authentication required and high integrity impact.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A new vulnerability, CVE-2026-58192, was published for Appium's storage plugin affecting versions prior to 1.1.6. The flaw allows an unauthenticated remote client to use path traversal in the POST /storage/delete handler to recursively delete arbitrary writable files or directories, and the publication notes that version 1.1.6 fixes the issue.
Appium published @appium/storage-plugin version 1.1.6, adding fs.sanitizeName handling for the delete request. The release note references pull request #22362 and commit 5fee017 as part of the fix.
Appium committed code changes to the storage plugin adding fs.sanitizeName-based validation for delete requests, introducing validateStorageItemName reuse and updating API behavior documentation. The commit also added tests showing valid names are accepted while path-like and empty names are rejected.
Appium opened pull request #22362 to add fs.sanitizeName-based validation to the storage plugin's /storage/delete request handling. The PR described rejecting suspicious names such as path traversal-style input and reusing existing validation logic for storage item names.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity flaw tracked as **`CVE-2026-43910`** affects Appium Java Client versions **8.2.1 through before 10.1.1**, allowing server-side request forgery and network pivoting when `directConnect(true)` is enabled. The issue stems from `AppiumCommandExecutor.setDirectConnect()` rebuilding the client server URL from untrusted `NEW_SESSION` response fields while only verifying that the protocol is HTTPS, which means a rogue or compromised Appium server can redirect subsequent session traffic to attacker-chosen destinations. The vulnerability could let attackers intercept session traffic and reach internal network resources, including potential access to cloud metadata services such as IMDS for credential theft. Appium addressed the issue in **version 10.1.1** through additional security checks on the `overrideServerUrl` API, including validation logic designed to block unsafe direct-connect targets such as `0.0.0.0`, `[::]`, and multicast addresses; organizations are advised to upgrade to **10.1.1** or disable `directConnect` if they cannot update immediately.
Jul 28, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
Public proof-of-concept code has been released for three high-severity vulnerabilities in the open-source **File Browser** self-hosted file management application, including **`CVE-2026-73611`**, **`CVE-2026-73612`**, and **`CVE-2026-73613`**. The issues affect File Browser/File Server releases up to **2.63.21** in the broader advisory, while individual fixes were introduced in later versions, including **2.63.22** for the recursive-operations access-control flaw and **2.63.19** as unaffected for the symlink-based deletion issue. `CVE-2026-73612` allows authenticated users to bypass path-based access controls during recursive copy, rename, and delete operations, letting them manipulate restricted descendant files and directories. `CVE-2026-73613` enables arbitrary out-of-scope file deletion through symlink manipulation in the TUS upload cache eviction process, potentially deleting files outside an attacker’s authorized scope with only create permissions. Separately, `CVE-2026-73611` affects JWT-based proxy authentication and can allow expired tokens to be accepted and renewed under certain non-default logout configurations, creating an authentication and security-restrictions bypass risk. Organizations using File Browser have been urged to apply the latest vendor patches immediately.
Aug 14, 2026