CVE-2026-1703

Low

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.0; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,241; of 17,790 indexed, latest versions
Container images: 1,190; deployed by those charts
Fix available: 1 of 2; affected packages

pip Path Traversal vulnerability

Carried by container images the latest versions of 1,241 of 17,790 indexed charts deploy, on 1,190 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+63 more	26.0	1,183
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	141

OSV records: DEBIAN-CVE-2026-1703 GHSA-6vgw-5pg2-w6jp UBUNTU-CVE-2026-1703
Also known as: PYSEC-2026-1796

Charts affected

1,241 by stars

Chart

Latest

Affected images

Radar Score

fsmopenshift

0.1.8-ubi.6

1 of 6 See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	pip@9.0.3	26.0

Open the chart page →

16,563

hamiopenshift

2.10.0-r0-openshift.c4e22e88

1 of 2 See more

hami openshift 2.10.0-r0-openshift.c4e22e88

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	pip@9.0.3	26.0

Open the chart page →

4,756

orion-ldopenshift

1.0.3

2 of 2 See more

orion-ld openshift 1.0.3

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	pip@9.0.3	26.0
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	pip@9.0.3	26.0

Open the chart page →

14,727

osm-edgeopenshift

1.2.1-ubi8

1 of 7 See more

osm-edge openshift 1.2.1-ubi8

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	pip@9.0.3	26.0

Open the chart page →

19,471

open-webconceptopen-webconcept

0.1.0

1 of 3 See more

open-webconcept open-webconcept 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.0

Open the chart page →

3,423

terminalsopen-webui

0.7.0

2 of 2 See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	pip@25.0.1	26.0
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	pip@25.0.1	26.0

Open the chart page →

2,046

openwhiskopenwhisk

1.0.0

2 of 10 See more

openwhisk openwhisk 1.0.0

2 of the 10 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
openwhisk/kafkaprovider :2.1.0	63dc3d2a0904	pip@19.3.1	26.0
openwhisk/ow-utils :1.0.0	c80dba0de3aa	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.4	26.0 no fix listed

Open the chart page →

36,252

osdfir-infrastructureosdfir-infrastructure

2.15.0

8 of 40 See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

8 of the 40 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/openrelik/openrelik-mediator :latest	42efc445b19e	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-server :latest	ce1132261523	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed

Open the chart page →

72,547

mysqlot-container-kit

0.1.0

1 of 1 See more

463

pgaot-container-kit

1.0.3

1 of 6 See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	pip@24.0	26.0

Open the chart page →

5,143

vmot-container-kit

0.0.3

1 of 7 See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.0

Open the chart page →

5,418

devpiowan-charts

0.1.0

1 of 1 See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
owanio1992/devpi :6.16.0	4ade8e1e4d7e	pip@25.1.1	26.0

Open the chart page →

513

p4p4

0.1.0

1 of 7 See more

27,702

myappp4-helm

0.1.0

1 of 6 See more

19,728

pagespages

1.0.0

1 of 3 See more

20,242

pagespages10

1.0.0

1 of 3 See more

20,242

pagespages111

1.0.0

1 of 3 See more

20,242

pagespages2

1.0.0

1 of 3 See more

20,242

pagespages-alexchmielu

1.0.0

1 of 3 See more

20,242

pagespages-alps

1.0.0

1 of 3 See more

20,242

pagespages-alstom

1.0.0

1 of 3 See more

20,242

pagespages-ambala

1.0.0

1 of 3 See more

20,242

pagespages-andromeda

1.0.0

1 of 3 See more

20,242

pagespagesbadami

1.0.0

1 of 3 See more

20,242

pagespages-blackburn

1.0.0

1 of 3 See more

20,242

pagespages-botes

1.0.0

1 of 3 See more

20,242

pagespages-brian

1.0.0

1 of 3 See more

20,242

pagespages-buckll

1.0.0

1 of 3 See more

20,242

pagespages-camden

1.0.0

1 of 3 See more

20,242

pagespages-camden771

1.0.0

1 of 3 See more

20,242

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-draco

1.0.0

1 of 3 See more

20,242

pagespages-ellora

1.0.0

1 of 3 See more

20,242

pagespages-finchley

1.0.0

1 of 3 See more

20,242

pagespages-fornax

1.0.0

1 of 3 See more

20,242

pagespages-harsh

1.0.0

1 of 3 See more

20,242

pagespagesk

1.0.0

1 of 3 See more

20,242

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,242

pagespages-mihai

1.0.0

1 of 3 See more

20,242

pagespages-nivesh

1.0.0

1 of 3 See more

20,242

pagespagessandeepgudu

1.0.0

1 of 3 See more

20,242

pagespages-shubhanker

1.0.0

1 of 3 See more

20,242

pagespages-ssharma0909

1.0.0

1 of 3 See more

20,242

pagespages-sucharitha

1.0.0

1 of 3 See more

20,242

pagespages-sudhir

1.0.0

1 of 3 See more

20,242

pagespages-sushi

1.0.0

1 of 3 See more

20,242

pagespages-vasanth5814

1.0.0

1 of 3 See more

20,242

pagespages-vjp

1.0.0

1 of 3 See more

20,242

ctfdpascaliske

2.0.0

1 of 1 See more

2,393

home-assistantpascaliske

0.1.1

1 of 1 See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	pip@25.3	26.0

Open the chart page →

4,805

Container images carrying it

1,190 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/maxiv/storageclass-router :0.4.1	60725dab588c	pip@24.0	26.0	1
quay.io/mongodb/farm-intro-backend :0.1	1a9ce0b8fbd4	pip@21.2.4	26.0	1
quay.io/netscaler/netscaler-cpx :14.1-66.59	8602e36d4564	pip@22.0.4	26.0	1
quay.io/netscaler/netscaler-k8s-ingress-controller :4.1.17	55b12c2a8440	pip@24.0	26.0	1
quay.io/netscaler/netscaler-k8s-ingress-controller :4.2.26	a68453858339	pip@24.0	26.0	1
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	pip@22.0.4	26.0	1
quay.io/ongres/kubectl :v1.25.16-build-6.53	04dada9e4503	pip@23.2.1	26.0	1
quay.io/openshift/origin-cli :4.6	6722d5041b47	pip@9.0.3	26.0	1
quay.io/openshift/origin-console :4.10.0	0bbe8b451fa3	pip@9.0.3	26.0	1
quay.io/openshift/origin-jenkins-agent-base :latest	c241c971aef8	pip@9.0.3	26.0	1
quay.io/opsmxpublic/awsgit :v2-openssh	0d21ba756f44	pip@22.0.3	26.0	1
quay.io/opsmxpublic/awsgit :v3-js	15a6faada3d4	pip@22.0.4	26.0	1
quay.io/opsmxpublic/ubi8-oes-datascience :isd-spin-2025.10.01-af26a30d4-202511261054	d8f66f4117fe	pip@25.3	26.0	1
quay.io/opsmxpublic/ubi8-oes-db :v3.0.0	89ee6493af89	pip@9.0.3	26.0	1
quay.io/opsmxpublic/ubi8-oes-platform :isd-spin-2025.10.01-a7c191ec-202511261122	8ed603ab7417	pip@9.0.3	26.0	1
quay.io/ortelius/ms-compitem-crud :main-v10.0.1566-gf3f815	97b7f49eec76	pip@25.3	26.0	1
quay.io/ortelius/ms-dep-pkg-cud :main-v10.0.1670-g9abe11	0c0c881b509a	pip@25.3	26.0	1
quay.io/ortelius/ms-dep-pkg-r :main-v10.0.1705-g21b3dc	8a4150e94a45	pip@25.3	26.0	1
quay.io/ortelius/ms-sbom-export :main-v10.0.933-g2e222e	f43bdaa51598	pip@25.3	26.0	1
quay.io/ortelius/ms-scorecard :main-v10.0.1276-g966a8a	43337e52fdd4	pip@25.3	26.0	1
quay.io/ortelius/ms-textfile-crud :main-v10.0.1635-g5076aa	f5c4c8adfc82	pip@25.3	26.0	1
quay.io/ortelius/ms-validate-user :main-v10.0.1694-g98ed94	b5054bd4e97a	pip@25.3	26.0	1
quay.io/redhat-ai-dev/chatbot :latest	59fe607dfdf2	pip@24.0	26.0	1
quay.io/rhdh/rhdh-hub-rhel9 :latest	0b26358f5793	pip@22.3.1	26.0	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	pip@20.2.4	26.0	1
quay.io/soketi/pws :0.8-16-alpine	399d2e6b10ef	pip@21.2.4	26.0	1
quay.io/stackgres/operator :1.19.1	f241b0b20326	pip@23.2.1	26.0	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	pip@23.0.1	26.0	1
registry.gitlab.com/crafty-controller/crafty-4 :latest	166a06f73d8c	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed	1
registry.gitlab.com/dyff/dyff-api :0.57.5	b6c44d969163	pip@25.0.1	26.0	1
registry.gitlab.com/dyff/dyff-orchestrator :0.22.19	9bd5d93aaff7	pip@25.0.1	26.0	1
registry.gitlab.com/dyff/workflows-sink :0.16.3	564718e28931	pip@25.0.1	26.0	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb :4.4.5	cf72810d33f5	pip@9.0.3	26.0	1
registry.gitlab.com/infinitydon/registry/open5gs-aio :v2.2.2	f6385712935f	pip@20.0.2 python-pip@20.0.2-5ubuntu1.1	26.0 no fix listed	1
registry.gitlab.com/open-forms/design-catalogue :latest	f21f19346b29	pip@20.3.3	26.0	1
registry.gitlab.com/open-forms/forms-catalogue :latest	4eaf9c911f33	pip@21.2.4	26.0	1
registry.gitlab.com/open-forms/request-registry :latest	0886cbbc5f95	pip@21.2.4	26.0	1
registry.gitlab.com/radiology/infrastructure/study-governor :8.0.0	4e7faf6f8d5f	pip@22.0.4	26.0	1
registry.gitlab.com/xrow-public/ci-tools/tools :main	9b9d1ed86b6a	pip@23.3.2	26.0	1
registry.gitlab.com/xrow-public/helm-smtp/postfix :1.3.3	7eea4f0883dd	pip@25.0.1	26.0	1