An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record.
This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.
CVSS Details
- CVSS 4.0 Base Score: 6.9 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade iscsi-initiator-utils-iscsiuioUpgrade python3-iscsi-initiator-utils-debuginfoUpgrade python3-iscsi-initiator-utilsUpgrade iscsi-initiator-utils-iscsiuio-debuginfoUpgrade iscsi-initiator-utils-debugsourceUpgrade iscsi-initiator-utils-debuginfoUpgrade iscsi-initiator-utilsUpgrade iscsi-initiator-utils-devel | Aug 18, 2026 | Jul 29, 2026 |
| Redhat_linux | — | Upgrade iscsi-initiator-utils-debuginfoUpgrade python3-iscsi-initiator-utils-debuginfoUpgrade iscsi-initiator-utils-debugsourceUpgrade iscsi-initiator-utils-iscsiuioUpgrade iscsi-initiator-utils-iscsiuio-debuginfoUpgrade iscsi-initiator-utilsUpgrade python3-iscsi-initiator-utils | Jul 31, 2026 | Jul 29, 2026 |
| Rocky_linux | — | Upgrade iscsi-initiator-utils-debugsourceUpgrade iscsi-initiator-utilsUpgrade iscsi-initiator-utils-iscsiuio-debuginfoUpgrade iscsi-initiator-utils-debuginfoUpgrade python3-iscsi-initiator-utils-debuginfoUpgrade python3-iscsi-initiator-utilsUpgrade iscsi-initiator-utils-iscsiuio | Aug 13, 2026 | Aug 12, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub