Home

Description

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

PUBLISHED Reserved 2026-05-22 | Published 2026-06-04 | Updated 2026-06-04 | Assigner mitre




MEDIUM: 5.9CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Problem types

CWE-23 Relative Path Traversal

Product status

Default status
unaffected

17.0.0 (semver) before 26.1.7
affected

27.0.0 (semver) before 29.0.6
affected

30.0.0 (semver) before 32.0.2
affected

33.0.0 (semver) before 35.0.2
affected

References

www.openwall.com/lists/oss-security/2026/06/03/12

bugs.launchpad.net/ironic/+bug/2148333

www.openwall.com/lists/oss-security/2026/06/03/12

cve.org (CVE-2026-48681)

nvd.nist.gov (CVE-2026-48681)

Download JSON