Path Traversal in open-iscsi

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: SUSE

Description

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-44943

Affected Vendors & Products

Vendor	Product	Version / Range
open-iscsi	open-iscsi	From 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a Path Traversal vulnerability in open-iscsi where remote attackers can exploit improper pathname restrictions to create root-owned files outside the intended database directory. It allows injecting malicious lines into records through a man-in-the-middle attack.

Impact Analysis

An attacker could gain root-level access on the affected system, modify critical files, or execute arbitrary code. This could lead to complete system compromise, data theft, or denial of service.

Mitigation Strategies

Update open-iscsi to a patched version. If immediate patching is not possible, restrict network access to the service and monitor for suspicious file creation or modifications.

Hi! I’m here to help you understand CVE-2026-44943. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70