High [CVE-2026-44943] Privilege Escalation via Path Traversal

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

This vulnerability, known as Path Traversal, allows remote Man-in-the-Middle (MITM) attackers to manipulate file paths. By doing so, attackers can create files with root privileges outside the intended database and inject malicious content into system records.

This could lead to unauthorized system modification or privilege escalation. This is an Important vulnerability in the open-iscsi `iscsi-initiator-utils` package, enabling remote Man-in-the-Middle (MITM) attackers to achieve privilege escalation.

The path traversal flaw allows creating root-owned files and injecting malicious data into system records, posing a significant risk of unauthorized system modification without requiring user interaction or prior authentication. Red Hat severity: Important — CVSS 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N).

Weakness: CWE-22.