The Appium storage plugin exposes an unauthenticated POST /storage/delete endpoint that accepts a name parameter and then constructs a file path by joining the storage root with the supplied value before deleting it. Because the value is not sanitised, an attacker can supply ‘../’ sequences to traverse outside the storage root and recursively delete any writable file or directory on the server, leading to data loss or denial of service. This is a classic path traversal vulnerability (CWE‑22) that also allows absolute or relative path traversal (CWE‑73).

This flaw exists in Appium's storage-plugin in all releases prior to version 1.1.6 and is therefore present on every platform where the plugin is installed.

The CVSS score of 8.6 indicates a high severity vulnerability. Exploitation requires only a network connection to the Appium server; the endpoint is unauthenticated, so any remote client can trigger the deletion. EPSS indicates a low but nonzero exploitation probability, and the flaw is not listed in the CISA KEV catalog, but the straightforward attack surface and severe impact make it a high‑risk issue that should be addressed immediately.