CVE-2021-4472
Python-mistralclient: mistral-dashboard: local file inclusion through the 'create workbook' feature
The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Python-mistralclient: mistral-dashboard: local file inclusion through the 'create workbook' feature
The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content.
- Record
CVE-2021-4472- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-73
- Updated
- 2026-11-02
EUVDEUVD-2021-34723
The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content.
- Record
EUVD-2021-34723- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-75hx-6r6j-hw56
OpenStack's Mistral Client has a local file inclusion vulnerability
The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content.
- Record
GHSA-75hx-6r6j-hw56- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-73
- Updated
- 2026-11-02
NVD
The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content.
- Record
CVE-2021-4472- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-73
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-4472
The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content.
- Record
DEBIAN-CVE-2021-4472- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-75hx-6r6j-hw56
OpenStack's Mistral Client has a local file inclusion vulnerability
The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content.
- Record
GHSA-75hx-6r6j-hw56- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-73
- Updated
- 2026-11-02
OSVPYSEC-2026-1849
OpenStack's Mistral Client has a local file inclusion vulnerability
The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content.
- Record
PYSEC-2026-1849- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-4472
The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content.
- Record
UBUNTU-CVE-2021-4472- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15790-1 No score
python-mistralclient-doc-6.1.0-1.1 on GA media
These are all security issues fixed in the python-mistralclient-doc-6.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15790-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-mistralclientPyPI |
before 4.3.0 | 4.3.0 |
mistral-dashboardDebian:12 |
before 15.0.0~rc1-1 | 15.0.0~rc1-1 |
mistral-dashboardDebian:13 |
before 15.0.0~rc1-1 | 15.0.0~rc1-1 |
mistral-dashboardDebian:14 |
before 15.0.0~rc1-1 | 15.0.0~rc1-1 |
python-mistralclientDebian:12 |
before 1:4.3.0-2 | 1:4.3.0-2 |
python-mistralclientDebian:13 |
before 1:4.3.0-2 | 1:4.3.0-2 |
python-mistralclientDebian:14 |
before 1:4.3.0-2 | 1:4.3.0-2 |
python-mistralclientDebian:11 |
before 1:4.1.1-2+deb11u1, plus listed versions 1:4.1.1-2 |
1:4.1.1-2+deb11u1 |
mistral-dashboardDebian:11 |
before 11.0.0-2+deb11u1, plus listed versions 11.0.0-2 |
11.0.0-2+deb11u1 |
python-mistralclientPyPI |
before 4.3.0, plus listed versions 0.0.10.0.20.0.30.0.40.1 Show 38 moreShow less0.1.10.2.00.3.01.0.01.0.0.0b11.0.11.0.21.1.01.2.02.0.02.1.02.1.12.1.23.0.03.0.13.0.23.1.03.1.13.1.23.1.33.1.43.1.53.10.03.2.03.3.03.4.03.5.03.6.03.6.13.7.03.8.03.8.13.9.04.0.04.0.14.1.04.1.14.2.0 |
4.3.0 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mistral-dashboardUbuntu:20.04:LTS |
All versions, plus listed versions 7.0.1-29.0.0-19.0.0-1ubuntu1 |
None known |
mistral-dashboardUbuntu:22.04:LTS |
All versions, plus listed versions 11.0.0-213.0.0-1 |
None known |
mistral-dashboardUbuntu:24.04:LTS |
All versions, plus listed versions 16.0.0-417.0.0-1 |
None known |
mistral-dashboardUbuntu:25.10 |
All versions, plus listed versions 20.0.0-0ubuntu1 |
None known |
mistral-dashboardUbuntu:26.10 |
All versions, plus listed versions 20.0.0-0ubuntu222.0.0+git20260722.13.a2c6b1c-0ubuntu123.0.0~rc1-0ubuntu123.0.0-0ubuntu1 |
None known |
mistral-dashboardUbuntu:26.04:LTS |
All versions, plus listed versions 20.0.0-0ubuntu120.0.0-0ubuntu2 |
None known |
python-mistralclientopenSUSE:Tumbleweed |
before 6.1.0-1.1 | 6.1.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-4472 is a medium vulnerability (CVSS 6.5) in Red Hat Openstack Platform 13 (queens), published November 26, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in python-mistralclient 4.3.0.
References
access.redhat.com/security/cve/CVE-2021-4472
bugs.launchpad.net/horizon/+bug/1931558
bugzilla.redhat.com/show_bug.cgi?id=2417321
review.opendev.org/c/openstack/mistral-dashboard/+/800952
lists.debian.org/debian-lts-announce/2025/12/msg00002.html
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-4472
github.com/advisories/GHSA-75hx-6r6j-hw56
security-tracker.debian.org/tracker/CVE-2021-4472
opendev.org/openstack/mistral-dashboard
pypi.org/project/python-mistralclient
ubuntu.com/security/CVE-2021-4472
cve.org/CVERecord?id=CVE-2021-4472
suse.com/security/cve/CVE-2021-4472