CVE-2026-48681

Summary

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

Affected Software

VendorProductVersion RangeStatus
OpenStackIronic17.0.0 < 26.1.7affected
OpenStackIronic27.0.0 < 29.0.6affected
OpenStackIronic30.0.0 < 32.0.2affected
OpenStackIronic33.0.0 < 35.0.2affected

Weaknesses

  • CWE-23: CWE-23 Relative Path Traversal

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References