Appium Storage Plugin
Monthly
Unauthenticated arbitrary file/directory deletion in the Appium storage plugin (versions prior to 1.1.6) lets a remote client abuse the POST /storage/delete endpoint to recursively remove any file or directory the Appium process can write to. The handler feeds the user-supplied name straight into path.join(storageRoot, name) and fs.rimraf() with no sanitization, so ../ sequences escape the intended storage root. SSVC marks a proof-of-concept as available and the flaw as automatable; publicly available exploit code exists, though it is not listed in CISA KEV and EPSS is low (0.34%).
Unauthenticated arbitrary file/directory deletion in the Appium storage plugin (versions prior to 1.1.6) lets a remote client abuse the POST /storage/delete endpoint to recursively remove any file or directory the Appium process can write to. The handler feeds the user-supplied name straight into path.join(storageRoot, name) and fs.rimraf() with no sanitization, so ../ sequences escape the intended storage root. SSVC marks a proof-of-concept as available and the flaw as automatable; publicly available exploit code exists, though it is not listed in CISA KEV and EPSS is low (0.34%).