CVE-2026-44943 in open-iscsi
Summary
by MITRE • 07/29/2026
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record.
This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability under examination represents a critical path traversal flaw within the open-iscsi software implementation, specifically manifesting as an improper limitation of pathname to restricted directories. This security weakness enables remote attackers exploiting man-in-the-middle conditions to manipulate file system operations beyond intended boundaries. The flaw stems from inadequate input validation and sanitization mechanisms that fail to properly restrict directory access paths during database operations. Such vulnerabilities fall under the common weakness enumeration CWE-22, which categorizes path traversal issues as fundamental flaws in access control mechanisms.
The technical exploitation of this vulnerability occurs through crafted network requests that manipulate the iscsi database update process. When remote attackers successfully execute this attack, they can create files with root ownership outside of the designated database directory structure, effectively bypassing normal file system permissions and access controls. The attack vector specifically targets the record injection functionality within the iscsi database management system, allowing malicious actors to insert arbitrary content into database records while simultaneously establishing persistent files in privileged locations. This dual impact creates both data integrity concerns and potential privilege escalation opportunities.
The operational implications of this vulnerability extend beyond simple file system manipulation to encompass broader security implications for iSCSI storage environments. Organizations relying on open-iscsi implementations face significant risks including unauthorized data modification, potential system compromise through root-owned file creation, and disruption of normal database operations. The attack can be executed remotely without requiring local system access, making it particularly dangerous in networked environments where iSCSI services are exposed to untrusted networks. This vulnerability directly maps to ATT&CK technique T1059.007 for command and script injection, as well as T1566.002 for credential access through network infiltration, potentially enabling further exploitation pathways.
Mitigation strategies must address both the immediate path traversal flaw and broader security posture improvements. Organizations should implement strict input validation for all database update operations, particularly those involving file system paths and record insertion processes. The recommended solution involves enforcing absolute path restrictions and implementing comprehensive directory traversal checks within the open-iscsi codebase. Additionally, network segmentation should separate iSCSI services from untrusted networks, while implementing robust authentication mechanisms to prevent unauthorized access. Regular security updates and patch management procedures should be established to address similar vulnerabilities in related components. The fix should include proper validation of all pathname inputs through mechanisms such as canonicalization checks, directory whitelist enforcement, and privilege separation techniques that prevent creation of files outside designated directories. Organizations must also consider implementing monitoring solutions to detect anomalous file system activities that might indicate exploitation attempts.