Executive brief
open-iscsi is a software suite used to connect Linux systems to network-based storage. A vulnerability in how it handles storage target names allows a network attacker to create unauthorized files on the system with administrative privileges. This could lead to system instability or unauthorized modification of system records.
Technical details
A path traversal vulnerability (CWE-22) exists in open-iscsi's discovery handling of iSCSI Qualified Names (IQNs). The software uses received target names as directory names within the database (typically /var/lib/iscsi) without sufficient validation of prohibited ASCII characters defined in RFC 3722. A remote attacker, potentially via a Man-in-the-Middle (MITM) position or a malicious discovery server, can provide a crafted IQN containing sequences like '../../..' to create root-owned files outside the database directory. This issue is addressed in commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e by enforcing stricter IQN character validation.
Affected products
- open-iscsi open-iscsi through commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e
Timeline
- 2026-07-29: advisory: NVD publication date
- 2026-07-29: patched: Fix committed to open-iscsi repository