Cyber Resilience

CVE-2026-48681

MediumUpdated

Published: 04 June 2026

Published
04 June 2026
Modified
17 June 2026
KEV Added
—
Patch
—
CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0060 44.4th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-48681 is a medium-severity Relative Path Traversal (CWE-23) vulnerability in Openstack Ironic. Its CVSS base score is 5.9 (Medium).

Operationally, ranked at the 44.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

CWE(s)
CWE-23

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.
Confidence: LOW · MITRE ATT&CK Enterprise v19.0

Affected Assets

openstack
ironic
17.0.0 — 26.1.7 · 27.0.0 — 29.0.6 · 30.0.0 — 32.0.2

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References