OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image

ÉLEVÉE 8.1CVE-2026-48681 · GHSA-9v62-qx4c-44x5 · PYSEC-2026-3470 · Published 04/06/2026 · updated 22/07/2026

En bref

CVE-2026-48681 est une vulnérabilité ÉLEVÉE (CVSS 8.1) touchant ironic, ironic (openstack).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.60%, plus élevée que 48.8% des vulnérabilités.
Correctif : mettre à jour vers 26.1.7, 29.0.6, 32.0.2, 35.0.2 ou plus récent.

Package	Affected versions	Patched versions
ironic PyPI	`≥ 17.0.0, < 26.1.7≥ 27.0.0, < 29.0.6≥ 30.0.0, < 32.0.2≥ 33.0.0, < 35.0.2`	`26.1.729.0.632.0.235.0.2`
ironic openstack	`≥ 17.0.0, < 26.1.7≥ 27.0.0, < 29.0.6≥ 30.0.0, < 32.0.2≥ 33.0.0, < 35.0.2`	`26.1.729.0.632.0.235.0.2`

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

NVD description

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

≥ 17.0.0, < 26.1.7≥ 27.0.0, < 29.0.6≥ 30.0.0, < 32.0.2≥ 33.0.0, < 35.0.2

26.1.729.0.632.0.235.0.2

≥ 17.0.0, < 26.1.7≥ 27.0.0, < 29.0.6≥ 30.0.0, < 32.0.2≥ 33.0.0, < 35.0.2

26.1.729.0.632.0.235.0.2

Autres vulnérabilités de ironic

Tout voir →