{"id":"CVE-2026-44943","summary":"remote limited file-write as root via discovery in open-iscsi","details":"An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers  to create root-owned files outside the database and inject lines into the record.\n\n\n\n\n\n\nThis issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.","modified":"2026-08-01T08:23:04.779260Z","published":"2026-07-29T12:58:49.817Z","related":["openSUSE-SU-2026:11317-1"],"database_specific":{"cna_assigner":"suse","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44943.json","unresolved_ranges":[{"extracted_events":[{"introduced":"?"},{"last_affected":"668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e"}],"source":"AFFECTED_FIELD"},{"source":"DESCRIPTION","extracted_events":[{"fixed":"668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e"}]}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44943.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44943"},{"type":"REPORT","url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-44943"},{"type":"FIX","url":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open-iscsi/open-iscsi","events":[{"introduced":"0"},{"fixed":"668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e"}],"database_specific":{"source":"REFERENCES"}}],"versions":["2.1.11","2.1.10","2.1.9","2.1.7","2.1.6","2.1.5","2.1.4","2.1.3","2.1.2","2.1.0","2.0.878","2.0.877","2.0.876","2.0.875","2.0.874","2.0.873"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44943.json","vanir_signatures_modified":"2026-08-01T08:23:04Z","vanir_signatures":[{"digest":{"function_hash":"234155107440779935736282635754067279335","length":3112},"id":"CVE-2026-44943-06e501de","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"usr/discovery.c","function":"discovery_isns_query"},"deprecated":false},{"source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"function":"discovery_isns_reg_node","file":"usr/discovery.c"},"deprecated":false,"digest":{"function_hash":"218722674135731319498316465810666013820","length":1147},"id":"CVE-2026-44943-0adb06da","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["14722739685535177145227048387826414302","69242526050992702030608613110327143491","322589338340157935634494497697342682411","144192728533476265023125276780510452496"],"threshold":0.9},"id":"CVE-2026-44943-20acbeac","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"usr/iscsistart.c"}},{"source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"usr/iscsistart.c","function":"main"},"deprecated":false,"digest":{"function_hash":"120361746734299385514916582863098774959","length":4705},"id":"CVE-2026-44943-3acb7305","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"usr/iscsiadm.c","function":"exec_disc_op_on_recs"},"deprecated":false,"digest":{"function_hash":"261087157498683897136877044555651405124","length":963},"id":"CVE-2026-44943-3da7aa17","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"iscsiuio/src/unix/iscsid_ipc.c"},"deprecated":false,"digest":{"line_hashes":["59158746369333330547871875733174744805","296100887643099557226250545686499014771","240300800138313144191902787072051334758","150543996205726448559114558726487048063","154773265534532623166005655151971677249","83337467462007182181924272134438485432","138667331354269941743567863763741597745"],"threshold":0.9},"id":"CVE-2026-44943-5b864040","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-44943-747acb4c","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"usr/initiator.h"},"deprecated":false,"digest":{"line_hashes":["82397512541519343514368775161759770372","66333901412556814279069007839504320573","251405028637901866450288246246362208849","292116255081475621265361682481547440432"],"threshold":0.9}},{"target":{"file":"iscsiuio/src/unix/iscsid_ipc.c","function":"iscsid_loop"},"deprecated":false,"digest":{"function_hash":"210677901587003948915603983630160819111","length":1125},"id":"CVE-2026-44943-830752f8","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e"},{"id":"CVE-2026-44943-857ab1d9","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"usr/iscsiadm.c"},"deprecated":false,"digest":{"line_hashes":["7237487927917169663176282050099825850","20741529215795224615051636605188726549","59439018414944335544581565376794056567","9152805459615786884311836284498256530"],"threshold":0.9}},{"id":"CVE-2026-44943-ba1aefb5","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"usr/discovery.c","function":"add_target_record"},"deprecated":false,"digest":{"function_hash":"87968220264877939529941293760451822798","length":1599}},{"target":{"file":"usr/discovery.c"},"deprecated":false,"digest":{"line_hashes":["335584415041921091737298524604908997120","105279378104460838901831576701193152611","105857790044612101199936671500635754325","43432125830909746330283552467153672575","174706434573723572822427255013325900755","72662564552827018822351897189697216199","210867617079644248891360496077910082360","284766815751440630424479232743657563869","45984452319758561090106512972612744686","124898477295598043698973202468370699000","238999011614284875811538488073870326080","67925512873573470896495790544078741858","34476021854864360663593129651033717421","135810147794008738843191704155480849714"],"threshold":0.9},"id":"CVE-2026-44943-be5ac0c9","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e"},{"deprecated":false,"digest":{"line_hashes":["240766703168005188945468331196914646145","304938971671869896450974934501387742534","106438839204855802403035916179644233410","230405382682465619740373895979501185814","101368393474163512253845269023945559967"],"threshold":0.9},"id":"CVE-2026-44943-fad07016","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e","target":{"file":"usr/initiator_common.c"}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}