Directory traversal file overwrite in OpenStack Ironic ISO handling (CVE-2026-48681)

A vulnerability in OpenStack Ironic's ISO handling code allows a maliciously crafted ISO image to cause path traversal, enabling arbitrary file overwrite on the Ironic conductor's disk. In the anaconda deploy interface, the same flaw can be exploited to overwrite files on the target disk during deployment. Any Ironic user with access to deploy nodes via configdrive, a virtual media-based boot interface, or the anaconda deploy interface can exploit this issue. Affected versions: - >=17.0.0 <26.1.7 - >=27.0.0 <29.0.6 - >=30.0.0 <32.0.2 - >=33.0.0 <35.0.2 We recommend updating to: 26.1.7, 29.0.6, 32.0.2, 35.0.2. CVSS 8.1 · our assessment: this_week Reference: https://seclists.org/oss-sec/2026/q2/798 Details: https://vuln.today/cve/CVE-2026-48681