openstack/ironic · Security
OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image
- GHSA ID
- GHSA-9v62-qx4c-44x5
- CVE ID
- CVE-2026-48681
- Severity
- medium
- Published
- Updated
- CVSS
- 5.9 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
- CVSS v3
- 5.9 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Description
OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.
CWEs
- CWE-23 · Relative Path Traversal