CVE-2026-28676
Path Injection Vulnerability in OpenSift Storage Helpers
Publication date: 2026-03-06
Last updated on: 2026-03-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| opensift | opensift | to 1.6.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-28676 is a high-severity vulnerability in OpenSift, an AI study tool, caused by insufficient enforcement of base-directory containment in multiple storage helper modules. This flaw allows attackers to inject malicious path-like values that bypass directory restrictions, enabling unauthorized file read, write, or delete operations outside the intended storage directories.'}, {'type': 'paragraph', 'content': 'The vulnerability is a form of path traversal (CWE-22), where special path elements like "../" are not properly neutralized, allowing attackers to escape restricted directories.'}, {'type': 'paragraph', 'content': 'It affects versions prior to 1.6.3-alpha and was patched by updating backend modules to consistently enforce scoped base directories.'}] [1]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized access to sensitive data, unauthorized modification of files, and potential disruption of service.
- Attackers can read confidential files outside the intended directories, compromising confidentiality.
- Attackers can modify or delete files, affecting data integrity and availability.
- The vulnerability can be exploited remotely with low complexity and without user interaction, increasing the risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves path traversal risks in OpenSift storage helper modules due to insufficient path containment checks. Detection can focus on identifying unauthorized file read, write, or delete operations outside the intended OpenSift storage directories.'}, {'type': 'paragraph', 'content': 'You can monitor filesystem access logs or audit logs for suspicious file operations involving path traversal patterns such as "../" sequences in file paths related to OpenSift directories.'}, {'type': 'paragraph', 'content': 'Suggested commands include:'}, {'type': 'list_item', 'content': "Using grep to find suspicious path usage in logs: grep -r '\\.\\./' /path/to/opensift/logs"}, {'type': 'list_item', 'content': 'Using auditd to monitor file access outside expected directories by setting audit rules on OpenSift storage directories.'}, {'type': 'list_item', 'content': 'Checking running OpenSift version to confirm if it is vulnerable: python3 -c "import opensift; print(opensift.__version__)"'}, {'type': 'list_item', 'content': 'Reviewing source code or runtime modules (flashcard_store.py, quiz_store.py, session_store.py, source_store.py, ui_app.py) for path construction patterns that do not enforce base-directory containment.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading OpenSift to version 1.6.3-alpha or later, where the vulnerability has been patched by enforcing scoped base directories in all storage helper modules.
Additionally, restrict filesystem permissions on runtime directories used by OpenSift to prevent unauthorized file operations.
Avoid importing untrusted manifests or metadata that could contain malicious path-like values.