CVE-2026-44943

Public on 2026-07-29

Modified on 2026-07-31

Description

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record.

This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

Severity

Important

See what this means

CVSS v3 Base Score

8.6

See breakdown

Affected Packages

Platform	Package	Release Date	Advisory	Status
Amazon Linux 2 - Core	iscsi-initiator-utils			Pending Fix
Amazon Linux 2023	iscsi-initiator-utils			Pending Fix

CVSS Scores

	Score Type	Score	Vector
Amazon Linux	CVSSv3	8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2026-44943 Mitre: CVE-2026-44943