Every CVE Search/ Get API key

CVE-2026-48681

OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image

5.9 MediumFix available

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.60%Up 0.4 points since Jun 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.9

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

Record
CVE-2026-48681
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-23
Updated
2026-11-02
EUVDEUVD-2026-34203 5.9

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

Record
EUVD-2026-34203
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-9v62-qx4c-44x5 5.9

OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

Record
GHSA-9v62-qx4c-44x5
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-23
Updated
2026-11-02
NVD 5.9

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

Record
CVE-2026-48681
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-23
Updated
2026-11-02
OSV 5.9

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

Record
CVE-2026-48681
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-23
Updated
2026-11-02
OSVDEBIAN-CVE-2026-48681 8.1

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

Record
DEBIAN-CVE-2026-48681
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-9v62-qx4c-44x5 5.9

OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

Record
GHSA-9v62-qx4c-44x5
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-23
Updated
2026-11-02
OSVPYSEC-2026-3470 5.9

OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

Record
PYSEC-2026-3470
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-48681 5.9

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

Record
UBUNTU-CVE-2026-48681
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUSN-8421-1 No score

ironic vulnerabilities

Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate file paths when handling ISO images. A privileged authenticated remote user could use this issue to perform path traversal via a crafted ISO image and overwrite arbitrary files on the Ironic conductor. (CVE-2026-48681)

Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic did not properly validate kernel command line parameters. A privileged authenticated remote user could use this issue to inject scripts during node boot and possibly execute arbitrary code. (CVE-2026-46447)

Dmitry Tantsur and Tuomo Tanskanen discovered that Ironic incorrectly restricted access to custom PXE templates. A privileged authenticated remote user could use this issue to read arbitrary sensitive files on the Ironic conductor. (CVE-2026-44917)

Record
USN-8421-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ironic
PyPI
 17.0.0 up to 26.1.7
26.1.7
ironic
PyPI
 27.0.0 up to 29.0.6
29.0.6
ironic
PyPI
 30.0.0 up to 32.0.2
32.0.2
ironic
PyPI
 33.0.0 up to 35.0.2
35.0.2
ironic
Debian:12
 before 1:21.4.4-0+deb12u1, plus listed versions
1:21.1.0-31:21.1.0-3+deb12u11:21.3.0-11:21.4.0-11:21.4.0-21:21.4.0-31:21.4.0-4
1:21.4.4-0+deb12u1
ironic
Debian:13
 before 1:29.0.5-0+deb13u2, plus listed versions
1:29.0.0-71:29.0.5-0+deb13u1
1:29.0.5-0+deb13u2
ironic
Debian:14
 before 1:35.0.1-5, plus listed versions
1:29.0.0-71:32.0.0-11:32.0.0-21:32.0.0-41:32.0.0-5
Show 8 moreShow less
1:32.0.0-61:32.0.0-71:34.0.0-11:35.0.0-11:35.0.0-21:35.0.1-11:35.0.1-21:35.0.1-3
1:35.0.1-5
ironic
PyPI
 17.0.0 up to 26.1.7, plus listed versions
17.0.117.0.217.0.317.0.417.1.0
Show 45 moreShow less
18.0.018.1.018.2.018.2.118.2.218.3.019.0.020.0.020.1.020.1.120.1.220.1.320.2.021.0.021.1.021.1.121.1.221.2.021.3.021.4.021.4.121.4.221.4.321.4.422.0.022.1.023.0.023.0.123.0.223.0.323.0.423.0.523.1.024.0.024.1.024.1.124.1.224.1.324.1.424.1.525.0.026.0.026.1.026.1.126.1.2
26.1.7
ironic
PyPI
 27.0.0 up to 29.0.6, plus listed versions
28.0.029.0.029.0.129.0.229.0.329.0.429.0.5
29.0.6
ironic
PyPI
 30.0.0 up to 32.0.2, plus listed versions
31.0.032.0.032.0.1
32.0.2
Show 7 moreShow less
Affected packages
PackageAffectedFixed
ironic
PyPI
 33.0.0 up to 35.0.2, plus listed versions
34.0.035.0.035.0.1
35.0.2
ironic
PyPI
 17.0.0 up to 26.1.7, 27.0.0 up to 29.0.6, 30.0.0 up to 32.0.2, 33.0.0 up to 35.0.2, plus listed versions
17.0.117.0.217.0.317.0.417.1.0
Show 45 moreShow less
18.0.018.1.018.2.018.2.118.2.218.3.019.0.020.0.020.1.020.1.120.1.220.1.320.2.021.0.021.1.021.1.121.1.221.2.021.3.021.4.021.4.121.4.221.4.321.4.422.0.022.1.023.0.023.0.123.0.223.0.323.0.423.0.523.1.024.0.024.1.024.1.124.1.224.1.324.1.424.1.525.0.026.0.026.1.026.1.126.1.2
26.1.729.0.632.0.235.0.2
ironic
Ubuntu:22.04:LTS
 before 1:20.1.0-0ubuntu1.3, plus listed versions
1:18.2.0-0ubuntu11:18.2.0+git2021120910.cdc3b9538-0ubuntu11:19.0.0+git2022011216.7beadee46-0ubuntu11:20.0.0+git2022030313.4e6a3d52e-0ubuntu11:20.1.0-0ubuntu11:20.1.0-0ubuntu1.11:20.1.0-0ubuntu1.2
1:20.1.0-0ubuntu1.3
ironic
Ubuntu:24.04:LTS
 before 1:24.1.1-0ubuntu1.3, plus listed versions
1:23.0.0-0ubuntu31:23.1.0+git2024011916.a374a0c1-0ubuntu11:24.1.0-0ubuntu11:24.1.1-0ubuntu11:24.1.1-0ubuntu1.2
1:24.1.1-0ubuntu1.3
ironic
Ubuntu:25.10
 before 1:32.0.0-0ubuntu1.1, plus listed versions
1:29.0.0-0ubuntu11:30.0.0+git2025070713.577833d78-0ubuntu11:30.0.0+git2025070713.577833d78-0ubuntu21:32.0.0-0ubuntu1
1:32.0.0-0ubuntu1.1
ironic
Ubuntu:26.10
 All versions, plus listed versions
1:35.0.0-0ubuntu21:35.0.0-0ubuntu31:38.0.0+git20260818.101.f8e78b0-0ubuntu11:38.0.0+git2026091517.26c022f13-0ubuntu11:39.0.0-0ubuntu1
 None known
ironic
Ubuntu:26.04:LTS
 before 1:35.0.0-0ubuntu2.1, plus listed versions
1:32.0.0-0ubuntu11:34.0.0-0ubuntu11:35.0.0-0ubuntu11:35.0.0-0ubuntu2
1:35.0.0-0ubuntu2.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-48681 is a medium vulnerability (CVSS 5.9) in Openstack Ironic, published June 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in ironic 26.1.7.

References

Show 7 moreShow less
This page doesn't list everything

Left out here: 21 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open