CVE-2026-44943CWE-22

remote limited file-write as root via discovery in open-iscsi

Medium · published July 29, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
31.4
In the wild
Unconfirmed
What it is

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into the record.

This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00385 · 31.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-29T12:58Z
EPSS history
Timeline
  • 29 JUL 12:58Z
    remote limited file-write as root via discovery in open-iscsi
    cvelistv5