An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record.
This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.
CVSS Details
- CVSS 4.0 Base Score: 6.9 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade iscsi-initiator-utilsUpgrade iscsi-initiator-utils-develUpgrade iscsi-initiator-utils-debuginfoUpgrade python3-iscsi-initiator-utils-debuginfoUpgrade iscsi-initiator-utils-iscsiuioUpgrade iscsi-initiator-utils-iscsiuio-debuginfoUpgrade iscsi-initiator-utils-debugsourceUpgrade python3-iscsi-initiator-utils | Aug 18, 2026 | Jul 29, 2026 |
| Redhat_linux | — | Upgrade iscsi-initiator-utils-debuginfoUpgrade python3-iscsi-initiator-utils-debuginfoUpgrade iscsi-initiator-utils-debugsourceUpgrade iscsi-initiator-utils-iscsiuioUpgrade iscsi-initiator-utils-iscsiuio-debuginfoUpgrade python3-iscsi-initiator-utilsUpgrade iscsi-initiator-utils | Jul 31, 2026 | Jul 29, 2026 |
| Rocky_linux | — | Upgrade iscsi-initiator-utils-iscsiuio-debuginfoUpgrade python3-iscsi-initiator-utilsUpgrade python3-iscsi-initiator-utils-debuginfoUpgrade iscsi-initiator-utils-debuginfoUpgrade iscsi-initiator-utils-iscsiuioUpgrade iscsi-initiator-utilsUpgrade iscsi-initiator-utils-debugsource | Aug 13, 2026 | Aug 12, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub