CVE-2015-1195
OpenStack Glance v2 API unrestricted path traversal through filesystem:// scheme
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
Exploit likelihood
What each source reports
NVD Score used
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
- Record
CVE-2015-1195- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
- Record
CVE-2015-1195- Updated
- 2026-11-02
EUVDEUVD-2022-4842 No score
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
- Record
EUVD-2022-4842- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pwrj-f53c-f89j No score
OpenStack Glance v2 API unrestricted path traversal through filesystem:// scheme
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem:// URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
- Record
GHSA-pwrj-f53c-f89j- Weakness
- CWE-22
- Updated
- 2026-11-02
OSV No score
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
- Record
CVE-2015-1195- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-1195 No score
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
- Record
DEBIAN-CVE-2015-1195- Updated
- 2026-11-02
OSVGHSA-pwrj-f53c-f89j No score
OpenStack Glance v2 API unrestricted path traversal through filesystem:// scheme
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem:// URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
- Record
GHSA-pwrj-f53c-f89j- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVPYSEC-2026-815 No score
OpenStack Glance v2 API unrestricted path traversal through filesystem:// scheme
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem:// URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
- Record
PYSEC-2026-815- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1195 is a medium vulnerability (CVSS 6.5) in Openstack Image Registry And Delivery Service \(glance\), published January 21, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.79%, the 86th percentile. Fixed in glance 11.0.0a0.
References
lists.openstack.org/pipermail/openstack-announce/2015-January/000325.html
bugs.launchpad.net/ossa/+bug/1408663
openwall.com/lists/oss-security/2015/01/18/5
secunia.com/advisories/62169
securityfocus.com/bid/71976
Show 9 moreShow less
oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
nvd.nist.gov/vuln/detail/CVE-2015-1195
github.com/openstack/glance/commit/5191ed1879c5fd5b2694f922bcedec232f461088
security-tracker.debian.org/tracker/CVE-2015-1195
pypi.org/project/glance