CVE-2026-1703

Low

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.0; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,241; of 17,790 indexed, latest versions
Container images: 1,190; deployed by those charts
Fix available: 1 of 2; affected packages

pip Path Traversal vulnerability

Carried by container images the latest versions of 1,241 of 17,790 indexed charts deploy, on 1,190 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+63 more	26.0	1,183
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	141

OSV records: DEBIAN-CVE-2026-1703 GHSA-6vgw-5pg2-w6jp UBUNTU-CVE-2026-1703
Also known as: PYSEC-2026-1796

Charts affected

1,241 by stars

Chart

Latest

Affected images

Radar Score

fsmopenshift

0.1.8-ubi.6

1 of 6 See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	pip@9.0.3	26.0

Open the chart page →

16,563

hamiopenshift

2.10.0-r0-openshift.c4e22e88

1 of 2 See more

hami openshift 2.10.0-r0-openshift.c4e22e88

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	pip@9.0.3	26.0

Open the chart page →

4,756

orion-ldopenshift

1.0.3

2 of 2 See more

orion-ld openshift 1.0.3

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	pip@9.0.3	26.0
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	pip@9.0.3	26.0

Open the chart page →

14,727

osm-edgeopenshift

1.2.1-ubi8

1 of 7 See more

osm-edge openshift 1.2.1-ubi8

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	pip@9.0.3	26.0

Open the chart page →

19,471

open-webconceptopen-webconcept

0.1.0

1 of 3 See more

open-webconcept open-webconcept 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.0

Open the chart page →

3,423

terminalsopen-webui

0.7.0

2 of 2 See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	pip@25.0.1	26.0
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	pip@25.0.1	26.0

Open the chart page →

2,046

openwhiskopenwhisk

1.0.0

2 of 10 See more

openwhisk openwhisk 1.0.0

2 of the 10 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
openwhisk/kafkaprovider :2.1.0	63dc3d2a0904	pip@19.3.1	26.0
openwhisk/ow-utils :1.0.0	c80dba0de3aa	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.4	26.0 no fix listed

Open the chart page →

36,252

osdfir-infrastructureosdfir-infrastructure

2.15.0

8 of 40 See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

8 of the 40 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/openrelik/openrelik-mediator :latest	42efc445b19e	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-server :latest	ce1132261523	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed

Open the chart page →

72,547

mysqlot-container-kit

0.1.0

1 of 1 See more

463

pgaot-container-kit

1.0.3

1 of 6 See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	pip@24.0	26.0

Open the chart page →

5,143

vmot-container-kit

0.0.3

1 of 7 See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.0

Open the chart page →

5,418

devpiowan-charts

0.1.0

1 of 1 See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
owanio1992/devpi :6.16.0	4ade8e1e4d7e	pip@25.1.1	26.0

Open the chart page →

513

p4p4

0.1.0

1 of 7 See more

27,702

myappp4-helm

0.1.0

1 of 6 See more

19,728

pagespages

1.0.0

1 of 3 See more

20,242

pagespages10

1.0.0

1 of 3 See more

20,242

pagespages111

1.0.0

1 of 3 See more

20,242

pagespages2

1.0.0

1 of 3 See more

20,242

pagespages-alexchmielu

1.0.0

1 of 3 See more

20,242

pagespages-alps

1.0.0

1 of 3 See more

20,242

pagespages-alstom

1.0.0

1 of 3 See more

20,242

pagespages-ambala

1.0.0

1 of 3 See more

20,242

pagespages-andromeda

1.0.0

1 of 3 See more

20,242

pagespagesbadami

1.0.0

1 of 3 See more

20,242

pagespages-blackburn

1.0.0

1 of 3 See more

20,242

pagespages-botes

1.0.0

1 of 3 See more

20,242

pagespages-brian

1.0.0

1 of 3 See more

20,242

pagespages-buckll

1.0.0

1 of 3 See more

20,242

pagespages-camden

1.0.0

1 of 3 See more

20,242

pagespages-camden771

1.0.0

1 of 3 See more

20,242

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-draco

1.0.0

1 of 3 See more

20,242

pagespages-ellora

1.0.0

1 of 3 See more

20,242

pagespages-finchley

1.0.0

1 of 3 See more

20,242

pagespages-fornax

1.0.0

1 of 3 See more

20,242

pagespages-harsh

1.0.0

1 of 3 See more

20,242

pagespagesk

1.0.0

1 of 3 See more

20,242

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-mihai

1.0.0

1 of 3 See more

20,242

pagespages-nivesh

1.0.0

1 of 3 See more

20,242

pagespagessandeepgudu

1.0.0

1 of 3 See more

20,242

pagespages-shubhanker

1.0.0

1 of 3 See more

20,242

pagespages-ssharma0909

1.0.0

1 of 3 See more

20,242

pagespages-sucharitha

1.0.0

1 of 3 See more

20,242

pagespages-sudhir

1.0.0

1 of 3 See more

20,242

pagespages-sushi

1.0.0

1 of 3 See more

20,242

pagespages-vasanth5814

1.0.0

1 of 3 See more

20,242

pagespages-vjp

1.0.0

1 of 3 See more

20,242

ctfdpascaliske

2.0.0

1 of 1 See more

2,393

home-assistantpascaliske

0.1.1

1 of 1 See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	pip@25.3	26.0

Open the chart page →

4,805

Container images carrying it

1,190 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed	1
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed	1
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed	1
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed	1
ghcr.io/open-telemetry/demo :1.12.0-loadgenerator	85c9935ff31b	pip@24.2	26.0	1
ghcr.io/open-telemetry/demo :1.12.0-recommendationservice	b294a4278407	pip@24.2	26.0	1
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	pip@25.0.1	26.0	1
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	pip@25.0.1	26.0	1
ghcr.io/oznu/homebridge :2022-07-08	ff2af53897e7	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	26.0 no fix listed	1
ghcr.io/paperless-ngx/paperless-ngx :2.13.1	0642357c5dbd	pip@24.2	26.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.13	4b05bcd28e69	pip@25.0.1	26.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.3	57ad9565bff3	pip@25.0.1	26.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.5	665f2f5cc548	pip@25.0.1	26.0	1
ghcr.io/paperless-ngx/paperless-ngx :1.8.0	9bbc9a90641e	pip@20.3.4	26.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.0.1	ab255bea133e	pip@23.2.1	26.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	pip@25.0.1	26.0	1
ghcr.io/parmincloud/haproxy-redis-sentinel :1.0.0	40a00a6456ae	pip@25.0.1	26.0	1
ghcr.io/porelli/firefox-sync :syncstorage-rs-mysql-0.18.2	7d244e514216	pip@20.3.4	26.0	1
ghcr.io/puckpuck/seashell :1.2	ef5e31333821	pip@23.2.1	26.0	1
ghcr.io/qubiva/qubiva :v0.3.2	cdf1e3329bfe	pip@24.0	26.0	1
ghcr.io/reezogit/aws-secrets-synchronizer :0.2.1	111ed7cf7b39	pip@23.2.1	26.0	1
ghcr.io/remla23-team17/app :1.0.0	5816dbddf47d	pip@22.0.4	26.0	1
ghcr.io/remla23-team17/model-service :1.0.0	aa59fe2c4f6a	pip@22.0.4	26.0	1
ghcr.io/rodg/rtmp-controller :latest	67f99a5beab7	pip@23.0.1	26.0	1
ghcr.io/samr037/node-debug-dashboard :0.3.0	c79b2e64a211	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.0 no fix listed	1
ghcr.io/serenita-org/vero :v0.8.3	e5a7ec714acc	pip@24.2	26.0	1
ghcr.io/sissbruecker/linkding :1.45.0	61b2eb9eed8e	pip@25.2	26.0	1
ghcr.io/skyoo2003/digdag :0.0.1	821fd6a6f2cd	pip@20.3.4	26.0	1
ghcr.io/smarter-project/audio-client :v3.1.2	3c8375dc5487	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	26.0 no fix listed	1
ghcr.io/smarter-project/image-detector :v2.5.3	1dcca70c6446	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	26.0 no fix listed	1
ghcr.io/squent/kuma-ingress-watcher :1.7.0	14d45b2a1f00	pip@24.3.1	26.0	1
ghcr.io/substra/substra-backend :1.0.1	21967f54ec86	pip@24.0	26.0	1
ghcr.io/sudo-kraken/3d-printing-cost-calculators :v1.1.1	220c5e4e1a3d	pip@25.2	26.0	1
ghcr.io/sudo-kraken/authentik-webfinger-proxy :v1.1.1	e1351a977607	pip@25.2	26.0	1
ghcr.io/sudo-kraken/fantasy-dice-chamber :v1.3.2	99fd4cb0f4fe	pip@25.2	26.0	1
ghcr.io/sudo-kraken/finances-tracker :v1.1.1	c73527cde81c	pip@25.2	26.0	1
ghcr.io/sudo-kraken/jf-pushover-webhook :v1.1.0	ee9cf22a39ab	pip@25.2	26.0	1
ghcr.io/tandoorrecipes/recipes :1.5.31	063eb446e298	pip@24.3.1	26.0	1
ghcr.io/tauffer-consulting/domino-rest :latest	8bf880fe8c73	pip@24.0	26.0	1
ghcr.io/texano00/urunner :0.6.0	7c8be1dae3cd	pip@25.0.1	26.0	1
ghcr.io/thoroslives/zilean :v3.10.1	bce6aca0f6ca	pip@23.1.2	26.0	1
ghcr.io/tremolosecurity/python-slim-nonroot/python3 :1.0.0	94f64e1f40cb	pip@23.1.2	26.0	1
ghcr.io/unique-ag/ai/search-proxy :2026.38.0	aa6699b027bb	pip@25.0.1	26.0	1
ghcr.io/vinny1892/octantis :latest	45459c0910fc	pip@25.0.1	26.0	1
ghcr.io/virtuos/librechat_exporter :2.0.0	50ea1cf0086f	pip@25.0.1	26.0	1
ghcr.io/wasi-master/13ft :0.3.4	563ce7794a71	pip@23.0.1	26.0	1
ghcr.io/wgbh-mla/ov-wag :v1.1.0	6df27f944fe8	pip@25.1.1	26.0	1
ghcr.io/wgbh-mla/pbcore-util :pr-6	6e04659a3baa	pip@25.0.1	26.0	1
ghcr.io/wittdennis/calibre-web :1.1.1	aa7d5d5dd6be	pip@25.0.1	26.0	1
ghcr.io/wittdennis/homeassistant-otbr :4.2.3	1b53b0b3488e	pip@25.1.1 python-pip@25.1.1+dfsg-1	26.0 no fix listed	1