← All advisories

Medium severity5.9NVD Advisory· Published Jun 4, 2026· Updated Jun 4, 2026

CVE-2026-48681

CVE-2026-48681

Description

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2

OpenStack/Ironic2 versions
cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:openstack:ironic:*:*:*:*:*:*:*:*range: >=17.0.0,<26.1.7
- (no CPE)range: <35.0.2

Patches

Vulnerability mechanics

References

3

www.openwall.com/lists/oss-security/2026/06/03/12nvdMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2026/06/03/12nvdMailing ListThird Party Advisory
bugs.launchpad.net/ironic/+bug/2148333nvdIssue TrackingMitigation

News mentions

1

OpenStack: Critical RCE and Multiple Ironic Flaws Disclosed Together
Vypr Intelligence · Jun 4, 2026