CVE-2026-1703

Low

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.0; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,241; of 17,787 indexed, latest versions
Container images: 1,190; deployed by those charts
Fix available: 1 of 2; affected packages

pip Path Traversal vulnerability

Carried by container images the latest versions of 1,241 of 17,787 indexed charts deploy, on 1,190 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+63 more	26.0	1,183
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	141

OSV records: DEBIAN-CVE-2026-1703 GHSA-6vgw-5pg2-w6jp UBUNTU-CVE-2026-1703
Also known as: PYSEC-2026-1796

Charts affected

1,241 by stars

Chart

Latest

Affected images

Radar Score

fsmopenshift

0.1.8-ubi.6

1 of 6 See more

fsm openshift 0.1.8-ubi.6

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.50.0-88	24352dca6672	pip@9.0.3	26.0

Open the chart page →

16,554

hamiopenshift

2.10.0-r0-openshift.c4e22e88

1 of 2 See more

hami openshift 2.10.0-r0-openshift.c4e22e88

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	pip@9.0.3	26.0

Open the chart page →

4,749

orion-ldopenshift

1.0.3

2 of 2 See more

orion-ld openshift 1.0.3

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/fiware/orion-ld :1.0.1	ea838e5b4051	pip@9.0.3	26.0
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	pip@9.0.3	26.0

Open the chart page →

14,727

osm-edgeopenshift

1.2.1-ubi8

1 of 7 See more

osm-edge openshift 1.2.1-ubi8

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/flomesh/pipy-ubi8 :0.70.0-46	35d87a381432	pip@9.0.3	26.0

Open the chart page →

19,449

open-webconceptopen-webconcept

0.1.0

1 of 3 See more

open-webconcept open-webconcept 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.0

Open the chart page →

3,423

terminalsopen-webui

0.7.0

2 of 2 See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	pip@25.0.1	26.0
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	pip@25.0.1	26.0

Open the chart page →

1,998

openwhiskopenwhisk

1.0.0

2 of 10 See more

openwhisk openwhisk 1.0.0

2 of the 10 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
openwhisk/kafkaprovider :2.1.0	63dc3d2a0904	pip@19.3.1	26.0
openwhisk/ow-utils :1.0.0	c80dba0de3aa	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.4	26.0 no fix listed

Open the chart page →

36,230

osdfir-infrastructureosdfir-infrastructure

2.15.0

8 of 40 See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

8 of the 40 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/openrelik/openrelik-mediator :latest	42efc445b19e	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-metrics :latest	3d0f1ddeebf5	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-server :latest	ce1132261523	pip@25.0.1	26.0
ghcr.io/openrelik/openrelik-worker-analyzer-config :latest	1269d3d8d2c2	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-analyzer-logs :latest	b175cc61959a	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed
ghcr.io/openrelik/openrelik-worker-os-creds :latest	7fc7ec101f08	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
ghcr.io/openrelik/openrelik-worker-plaso :latest	75537ea8c851	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed

Open the chart page →

72,154

mysqlot-container-kit

0.1.0

1 of 1 See more

463

pgaot-container-kit

1.0.3

1 of 6 See more

pga ot-container-kit 1.0.3

1 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	pip@24.0	26.0

Open the chart page →

5,136

vmot-container-kit

0.0.3

1 of 7 See more

vm ot-container-kit 0.0.3

1 of the 7 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	pip@24.0	26.0

Open the chart page →

5,410

devpiowan-charts

0.1.0

1 of 1 See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
owanio1992/devpi :6.16.0	4ade8e1e4d7e	pip@25.1.1	26.0

Open the chart page →

510

p4p4

0.1.0

1 of 7 See more

27,667

myappp4-helm

0.1.0

1 of 6 See more

19,725

pagespages

1.0.0

1 of 3 See more

20,233

pagespages10

1.0.0

1 of 3 See more

20,233

pagespages111

1.0.0

1 of 3 See more

20,233

pagespages2

1.0.0

1 of 3 See more

20,233

pagespages-alexchmielu

1.0.0

1 of 3 See more

20,233

pagespages-alps

1.0.0

1 of 3 See more

20,233

pagespages-alstom

1.0.0

1 of 3 See more

20,233

pagespages-ambala

1.0.0

1 of 3 See more

20,233

pagespages-andromeda

1.0.0

1 of 3 See more

20,233

pagespagesbadami

1.0.0

1 of 3 See more

20,233

pagespages-blackburn

1.0.0

1 of 3 See more

20,233

pagespages-botes

1.0.0

1 of 3 See more

20,233

pagespages-brian

1.0.0

1 of 3 See more

20,233

pagespages-buckll

1.0.0

1 of 3 See more

20,233

pagespages-camden

1.0.0

1 of 3 See more

20,233

pagespages-camden771

1.0.0

1 of 3 See more

20,233

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,233

pagespages-draco

1.0.0

1 of 3 See more

20,233

pagespages-ellora

1.0.0

1 of 3 See more

20,233

pagespages-finchley

1.0.0

1 of 3 See more

20,233

pagespages-fornax

1.0.0

1 of 3 See more

20,233

pagespages-harsh

1.0.0

1 of 3 See more

20,233

pagespagesk

1.0.0

1 of 3 See more

20,233

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

20,233

pagespages-mihai

1.0.0

1 of 3 See more

20,233

pagespages-nivesh

1.0.0

1 of 3 See more

20,233

pagespagessandeepgudu

1.0.0

1 of 3 See more

20,233

pagespages-shubhanker

1.0.0

1 of 3 See more

20,233

pagespages-ssharma0909

1.0.0

1 of 3 See more

20,233

pagespages-sucharitha

1.0.0

1 of 3 See more

20,233

pagespages-sudhir

1.0.0

1 of 3 See more

20,233

pagespages-sushi

1.0.0

1 of 3 See more

20,233

pagespages-vasanth5814

1.0.0

1 of 3 See more

20,233

pagespages-vjp

1.0.0

1 of 3 See more

20,233

ctfdpascaliske

2.0.0

1 of 1 See more

2,383

home-assistantpascaliske

0.1.1

1 of 1 See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	pip@25.3	26.0

Open the chart page →

4,788

Container images carrying it

1,190 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
danuk/telegram-sender :0.0.1	026560388070	pip@22.0.4	26.0	1
daskdev/dask :1.1.0	4ecd7bc35500	pip@10.0.1	26.0	1
daskdev/dask-notebook :1.1.0	052630f5ca04	pip@18.1	26.0	1
datadog/agent :7.22.0	8f20e56b5311	pip@20.1.1	26.0	1
datadog/agent :6	aad9994de6a7	pip@20.3.3	26.0	1
datamate/seafile-professional :11.0.20	2dd66b722464	pip@22.0.2 python-pip@22.0.2+dfsg-1ubuntu0.6	26.0 no fix listed	1
datawire/aes :2.0.3-ea	07f8fe4f4f8e	pip@20.2.4	26.0	1
datawire/aes :1.13.6	2beb65062c8b	pip@20.2.4	26.0	1
datawire/emissary :2.0.2-ea	9716efbdd24b	pip@20.2.4	26.0	1
dbanda/livy :0.8	0ca125e68e53	pip@20.1.1	26.0	1
dbanda/spark :2.4.6	d0e6367876ae	pip@20.1.1	26.0	1
dchesterton/amcrest2mqtt :1.0.9	cc70f2238aa9	pip@21.2.3	26.0	1
ddosify/selfhosted_alaz_backend :1.0.6	a43c5155fa1c	pip@24.0	26.0	1
ddosify/selfhosted_alaz_backend :2.3.11	e5be48b37348	pip@24.0	26.0	1
ddosify/selfhosted_backend :3.2.9	3c11e3182652	pip@24.0	26.0	1
ddosify/selfhosted_backend :2.6.11	ac323d52bfb4	pip@24.0	26.0	1
ddosify/selfhosted_hammermanager :1.2.4	71b8768f49bc	pip@22.0.4	26.0	1
ddosify/selfhosted_hammermanager :2.0.2	b796b8c73011	pip@24.0	26.0	1
deepflowce/deepflow-app :v6.2.6.5	a1888d35e787	pip@22.0.4	26.0	1
dellemc/csm-application-mobility-controller :v0.1.0	148ada9060a9	pip@9.0.3	26.0	1
devopsgoofy/k8s-platform :latest	ad865312099f	pip@24.3.1	26.0	1
devopshq/artifactory-cleanup :1.0.18	30e093bffa91	pip@23.0.1	26.0	1
devopstales/kubedash :3.1.0	8bb837da5aec	pip@24.0	26.0	1
devopstales/kube-openid-connector :1.0	42c40a0e9f1b	pip@22.0.4	26.0	1
devopstales/trivy-operator :2.5	75136aa7a26e	pip@22.0.4	26.0	1
dgtlmoon/sockpuppetbrowser :latest	f166a963b550	pip@24.0	26.0	1
dinutac/jinja2docker :2.1.8	9340dde8a8a4	pip@23.3.1	26.0	1
djjudas21/alertify :0.1.0	ba22be670c37	pip@25.0.1	26.0	1
djjudas21/autonodelabel :0.0.6	f17233350c4f	pip@23.1.2	26.0	1
djjudas21/ecowitt-exporter :2.2.0	73aab45ef10d	pip@25.0.1	26.0	1
djjudas21/liturgical-colour-app :0.7.2	954935971d42	pip@25.0.1	26.0	1
djjudas21/nova-exporter :0.0.10	e9094580885c	pip@25.0.1	26.0	1
dnationcloud/kubernetes-linter :0.2.1	dee6376560f5	pip@18.1	26.0	1
dockerid31415926/pod-pvc-mapping :v0.1.3	354309669f16	pip@21.2.4	26.0	1
dockerid31415926/pvc-exporter :v0.1.3	5a1dd17e0e07	pip@21.2.4	26.0	1
dongjiang1989/lxcfs :v6.0.3	4bf9ae391948	pip@20.0.2 python-pip@20.0.2-5ubuntu1.11	26.0 no fix listed	1
douz/helpdesk :latest	4384103d0219	pip@22.0.4	26.0	1
dpage/pgadmin4 :8.4	18cd5711fc9a	pip@23.3.1	26.0	1
dpage/pgadmin4 :7.5	37946e4f3e7b	pip@23.1.2	26.0	1
dpage/pgadmin4 :9.11.0	50700ac17936	pip@25.3	26.0	1
dpage/pgadmin4 :9.2	52cb72a9e3da	pip@24.3.1	26.0	1
dpage/pgadmin4 :8.13	561c1f8f99f2	pip@24.0	26.0	1
dpage/pgadmin4 :4.5	a5a656e1d5fd	pip@19.0.3	26.0	1
dpage/pgadmin4 :4.22	b1f00b8163cf	pip@20.1.1	26.0	1
drgrove/mtls-server :v0.14.2	361721759a2b	pip@19.1.1	26.0	1
drumsergio/duplicacy-exporter :0.3.4	ca3476077215	pip@25.3	26.0	1
dserio83/velero-api :0.3.1	6b3d9115fee2	pip@25.1.1 python-pip@23.0.1+dfsg-1	26.0 no fix listed	1
dserio83/velero-watchdog :0.1.8	d5deae589229	pip@23.0.1	26.0	1
dysnix/pritunl :v1.29-r8	19951e3e7a32	pip@20.2.2	26.0	1
eclipseaerios/aerios-k8s-shim :v1.0.0	d4ed3d8e5db4	pip@23.0.1	26.0	1