CVE-2026-1703

Low

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.0; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,241; of 17,790 indexed, latest versions
Container images: 1,190; deployed by those charts
Fix available: 1 of 2; affected packages

pip Path Traversal vulnerability

Carried by container images the latest versions of 1,241 of 17,790 indexed charts deploy, on 1,190 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+63 more	26.0	1,183
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	141

OSV records: DEBIAN-CVE-2026-1703 GHSA-6vgw-5pg2-w6jp UBUNTU-CVE-2026-1703
Also known as: PYSEC-2026-1796

Charts affected

1,241 by stars

Chart

Latest

Affected images

Radar Score

fsmopenshift

0.1.8-ubi.6

1 of 6 See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	pip@9.0.3	26.0

Open the chart page →

16,563

hamiopenshift

2.10.0-r0-openshift.c4e22e88

1 of 2 See more

hami openshift 2.10.0-r0-openshift.c4e22e88

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	pip@9.0.3	26.0

Open the chart page →

4,756

orion-ldopenshift

1.0.3

2 of 2 See more

orion-ld openshift 1.0.3

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	pip@9.0.3	26.0
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	pip@9.0.3	26.0

Open the chart page →

14,727

osm-edgeopenshift

1.2.1-ubi8

1 of 7 See more

osm-edge openshift 1.2.1-ubi8

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	pip@9.0.3	26.0

Open the chart page →

19,471

open-webconceptopen-webconcept

0.1.0

1 of 3 See more

open-webconcept open-webconcept 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.0

Open the chart page →

3,423

terminalsopen-webui

0.7.0

2 of 2 See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	pip@25.0.1	26.0
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	pip@25.0.1	26.0

Open the chart page →

2,046

openwhiskopenwhisk

1.0.0

2 of 10 See more

openwhisk openwhisk 1.0.0

2 of the 10 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
openwhisk/kafkaprovider :2.1.0	63dc3d2a0904	pip@19.3.1	26.0
openwhisk/ow-utils :1.0.0	c80dba0de3aa	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.4	26.0 no fix listed

Open the chart page →

36,252

osdfir-infrastructureosdfir-infrastructure

2.15.0

8 of 40 See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

8 of the 40 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/openrelik/openrelik-mediator :latest	42efc445b19e	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-server :latest	ce1132261523	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed

Open the chart page →

72,547

mysqlot-container-kit

0.1.0

1 of 1 See more

463

pgaot-container-kit

1.0.3

1 of 6 See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	pip@24.0	26.0

Open the chart page →

5,143

vmot-container-kit

0.0.3

1 of 7 See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.0

Open the chart page →

5,418

devpiowan-charts

0.1.0

1 of 1 See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
owanio1992/devpi :6.16.0	4ade8e1e4d7e	pip@25.1.1	26.0

Open the chart page →

513

p4p4

0.1.0

1 of 7 See more

27,702

myappp4-helm

0.1.0

1 of 6 See more

19,728

pagespages

1.0.0

1 of 3 See more

20,242

pagespages10

1.0.0

1 of 3 See more

20,242

pagespages111

1.0.0

1 of 3 See more

20,242

pagespages2

1.0.0

1 of 3 See more

20,242

pagespages-alexchmielu

1.0.0

1 of 3 See more

20,242

pagespages-alps

1.0.0

1 of 3 See more

20,242

pagespages-alstom

1.0.0

1 of 3 See more

20,242

pagespages-ambala

1.0.0

1 of 3 See more

20,242

pagespages-andromeda

1.0.0

1 of 3 See more

20,242

pagespagesbadami

1.0.0

1 of 3 See more

20,242

pagespages-blackburn

1.0.0

1 of 3 See more

20,242

pagespages-botes

1.0.0

1 of 3 See more

20,242

pagespages-brian

1.0.0

1 of 3 See more

20,242

pagespages-buckll

1.0.0

1 of 3 See more

20,242

pagespages-camden

1.0.0

1 of 3 See more

20,242

pagespages-camden771

1.0.0

1 of 3 See more

20,242

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-draco

1.0.0

1 of 3 See more

20,242

pagespages-ellora

1.0.0

1 of 3 See more

20,242

pagespages-finchley

1.0.0

1 of 3 See more

20,242

pagespages-fornax

1.0.0

1 of 3 See more

20,242

pagespages-harsh

1.0.0

1 of 3 See more

20,242

pagespagesk

1.0.0

1 of 3 See more

20,242

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-mihai

1.0.0

1 of 3 See more

20,242

pagespages-nivesh

1.0.0

1 of 3 See more

20,242

pagespagessandeepgudu

1.0.0

1 of 3 See more

20,242

pagespages-shubhanker

1.0.0

1 of 3 See more

20,242

pagespages-ssharma0909

1.0.0

1 of 3 See more

20,242

pagespages-sucharitha

1.0.0

1 of 3 See more

20,242

pagespages-sudhir

1.0.0

1 of 3 See more

20,242

pagespages-sushi

1.0.0

1 of 3 See more

20,242

pagespages-vasanth5814

1.0.0

1 of 3 See more

20,242

pagespages-vjp

1.0.0

1 of 3 See more

20,242

ctfdpascaliske

2.0.0

1 of 1 See more

2,393

home-assistantpascaliske

0.1.1

1 of 1 See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	pip@25.3	26.0

Open the chart page →

4,805

Container images carrying it

1,190 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/ctfd/ctfd :3.8.2	870e396fddf8	pip@24.0	26.0	1
ghcr.io/cunningpike/fediblockhole :0.4.2	2abc5f0350dc	pip@22.3.1	26.0	1
ghcr.io/danny-avila/librechat :v0.7.8	7fe76551a78e	pip@24.3.1	26.0	1
ghcr.io/danny-avila/librechat-rag-api-dev-lite :latest	f9f34c8ed688	pip@25.0.1	26.0	1
ghcr.io/dask/dask :2024.1.0	080150de7d86	pip@23.2.1	26.0	1
ghcr.io/dask/dask-gateway-server :2024.1.0	881e7acfc5a0	pip@23.2.1	26.0	1
ghcr.io/dask/dask-gateway-server :2026.3.0	afa5a729114e	pip@25.2	26.0	1
ghcr.io/dask/dask-kubernetes-operator :2026.3.0	3225d2bc6b3c	pip@25.0.1	26.0	1
ghcr.io/dask/dask-notebook :2024.1.0	f53bde3acd4f	pip@23.3.2	26.0	1
ghcr.io/developmentseed/titiler :0.22.4	8ac53eb38393	pip@25.1.1	26.0	1
ghcr.io/dfir-iris/iriswebapp_app :v2.4.26	e59ebde55709	pip@23.0.1	26.0	1
ghcr.io/dgtlmoon/changedetection.io :0.60.4	7bb6963b730d	pip@24.0	26.0	1
ghcr.io/dgtlmoon/changedetection.io :0.60.6	eb4a9f718801	pip@24.0	26.0	1
ghcr.io/dgtlmoon/changedetection.io :0.60.3 :latest	ecacd9fd0c66	pip@24.0	26.0	1
ghcr.io/dgtlmoon/changedetection.io :0.39.4	f1ce4c56ccaa	pip@21.2.4	26.0	1
ghcr.io/dgtlmoon/changedetection.io :0.60.5	f69554198005	pip@24.0	26.0	1
ghcr.io/djerfy/zabbix-kubernetes-discovery :v1.4.20	7a50c07e7c69	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.1	26.0 no fix listed	1
ghcr.io/dmunozv04/isponsorblocktv :v2.9.0	5b8cfa805cb6	pip@25.3	26.0	1
ghcr.io/dodevops/azure-advanced-backup :0.4.0	1041d4449e49	pip@22.0.4	26.0	1
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter :0.1.38	b472877847f5	pip@21.2.4	26.0	1
ghcr.io/drewburr-labs/mum-discord-bot :3.1.2	6e82914e1051	pip@23.2.1	26.0	1
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	pip@9.0.3	26.0	1
ghcr.io/element-hq/synapse :v1.111.0	22ae556e0de4	pip@24.0	26.0	1
ghcr.io/emissary-ingress/emissary :4.1.0	4a981156abee	pip@24.3.1	26.0	1
ghcr.io/erlkoenig91/prompt-db-backend :1.0.7	ab120359810d	pip@25.0.1	26.0	1
ghcr.io/eshepelyuk/dckr/cmak2zk :1.2.0	22de6314c31e	pip@21.2.4	26.0	1
ghcr.io/eslupmi/impulse :v3.7.0	3ded1b7ebca0	pip@25.0.1	26.0	1
ghcr.io/esomore/bitcoin-prometheus-exporter :master	ded173632986	pip@25.0.1	26.0	1
ghcr.io/facebook/threatexchange/hma :1.0.17	84d09c6b75a7	pip@24.0	26.0	1
ghcr.io/feresberbeche/alertigate :1.2.1	628d49e0e01b	pip@25.0.1	26.0	1
ghcr.io/flaresolverr/flaresolverr :v3.3.16	088412db1051	pip@24.0	26.0	1
ghcr.io/flaresolverr/flaresolverr :v3.4.0	ab535d1fef5d	pip@25.2	26.0	1
ghcr.io/flaresolverr/flaresolverr :v3.3.21	f104ee51e512	pip@24.0	26.0	1
ghcr.io/gamosoft/notediscovery :0.31.5	c06aa0fa9a85	pip@24.0	26.0	1
ghcr.io/getsentry/sentry :26.7.2	7c5052aa4e3c	pip@24.3.1	26.0	1
ghcr.io/getsentry/snuba :26.7.2	10f8d164109b	pip@25.3	26.0	1
ghcr.io/glassflow/glassflow-notifier :v1.0.3	d1b0ce10b513	pip@24.0	26.0	1
ghcr.io/grofers/legend :0.1	d6e901ad0ebd	pip@20.2.4	26.0	1
ghcr.io/hemslo/chat-search :latest	39d48995a5bd	pip@24.0	26.0	1
ghcr.io/home-assistant/home-assistant :2025.3.0	26c51e44d932	pip@25.0.1	26.0	1
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	pip@25.3	26.0	1
ghcr.io/home-assistant/home-assistant :2022.5.4	ec6d67fbedfa	pip@22.0.3	26.0	1
ghcr.io/home-assistant/home-assistant :2023.11.3	feffc0b8227d	pip@23.3.1	26.0	1
ghcr.io/home-operations/beets :2.3.1	cc4975f1a0be	pip@25.0.1	26.0	1
ghcr.io/home-operations/home-assistant :2026.3.1	067e54e2e107	pip@25.3	26.0	1
ghcr.io/home-operations/qbittorrent :5.1.4	bb82ad6668f8	pip@25.3	26.0	1
ghcr.io/hoverkraft-tech/ovh-snapshoter/app :0.4.10	10d271f08ab3	pip@24.3.1	26.0	1
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	pip@25.3	26.0	1
ghcr.io/ideamixes/object-cloner :2.0.0	31030fd2f192	pip@23.1.2	26.0	1
ghcr.io/immich-app/immich-machine-learning :v2.3.1	379e31b8c751	pip@24.0	26.0	1