CVE-2026-28676 - Vulnerability Analysis
HighCVSS: 8.8Last Updated: March 6, 2026
OpenSift - Path Traversal
Published: March 6, 2026Updated: March 6, 2026Remote Exploitable
Overview
OpenSift < 1.6.3-alpha contains a path traversal caused by improper base-directory containment enforcement in storage helpers, letting attackers perform unauthorized file read/write/delete, exploit requires malicious path-like input.
Severity & Score
Severity: High
CVSS Score: 8.8
Impact
Attackers can read, write, or delete arbitrary files, potentially compromising system integrity and data confidentiality.
Mitigation
Update to version 1.6.3-alpha or later.
References
- https://github.com/OpenSift/OpenSift/commit/1126e0a503876056a68a434e19f64158a5a4840b
- https://github.com/OpenSift/OpenSift/commit/de99b9c
- https://github.com/OpenSift/OpenSift/pull/67
- https://github.com/OpenSift/OpenSift/releases/tag/v1.6.3-alpha
- https://github.com/OpenSift/OpenSift/security/advisories/GHSA-ww4m-c7hv-2rqv
Related Resources
Details
- CVE ID
- CVE-2026-28676
- Severity
- High
- CVSS Score
- 8.8
- Type
- path_traversal
- Status
- new
CWE
- CWE-22
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H