GitHub Advisoryadvisory · PyPI

GHSA-9v62-qx4c-44x5 OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image

MEDIUM Published 2026-06-04 Modified 2026-07-14 Official page ↗
Aliases
CVE-2026-48681
Ecosystem
PyPI
Packages
ironic
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-23
Reviewed
2026-07-14

Affected packages

• PyPI ironic: >= 17.0.0, < 26.1.7 → fixed in 26.1.7 • PyPI ironic: >= 27.0.0, < 29.0.6 → fixed in 29.0.6 • PyPI ironic: >= 30.0.0, < 32.0.2 → fixed in 32.0.2 • PyPI ironic: >= 33.0.0, < 35.0.2 → fixed in 35.0.2

Description

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

Related

Alias · CVE (1)

  • CVE-2026-48681 OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image. vulnerability

Weakness · CWE (1)

  • CWE-23 Relative Path Traversal weakness

References