CVE-2026-1703

Low

Advisory

Published 2 Feb 2026In the index since 5 Sept 2026

Severity: Low; worst across findings
CVSS: 2.0; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,241; of 17,787 indexed, latest versions
Container images: 1,190; deployed by those charts
Fix available: 1 of 2; affected packages

pip Path Traversal vulnerability

Carried by container images the latest versions of 1,241 of 17,787 indexed charts deploy, on 1,190 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+63 more	26.0	1,183
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+25 more	no fix listed	141

OSV records: DEBIAN-CVE-2026-1703 GHSA-6vgw-5pg2-w6jp UBUNTU-CVE-2026-1703
Also known as: PYSEC-2026-1796

Charts affected

1,241 by stars

Chart

Latest

Affected images

Radar Score

flaresolverrkubernetes-homelab-helm-charts

0.1.2

1 of 1 See more

flaresolverr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/flaresolverr/flaresolverr :v3.4.6	7962759d99d7	pip@25.2	26.0

Open the chart page →

33,591

ghostkubernetes-homelab-helm-charts

0.1.2

1 of 2 See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :8	b3b90af2a655	pip@25.3	26.0

Open the chart page →

2,757

pve-exporterkubernetes-homelab-helm-charts

0.1.0

1 of 1 See more

pve-exporter kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
prompve/prometheus-pve-exporter :3.8.2	e3d501a82df5	pip@25.0.1	26.0

Open the chart page →

994

pypiserverkubernetes-replicator

0.0.1

1 of 1 See more

pypiserver kubernetes-replicator 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
pypiserver/pypiserver :v1.4.2	c9250d3c418d	pip@20.2.3	26.0

Open the chart page →

1,614

whatsappkubernetes-whatsapp

0.1.8

1 of 4 See more

whatsapp kubernetes-whatsapp 0.1.8

1 of the 4 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/python :3.8-alpine	3d93b1f77efc	pip@23.0.1	26.0

Open the chart page →

1,573

gitlabkubesphere

4.2.3

3 of 17 See more

gitlab kubesphere 4.2.3

3 of the 17 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
mirrorgitlabcontainers/gitlab-sidekiq-ce :v13.2.2	94d1431683fa	pip@20.1.1	26.0
mirrorgitlabcontainers/gitlab-task-runner-ce :v13.2.2	9efd73993c34	pip@20.1.1	26.0
mirrorgitlabcontainers/gitlab-webservice-ce :v13.2.2	30393f990f5c	pip@20.1.1	26.0

Open the chart page →

38,135

deepflowkubesphere-stable

6.2.606

1 of 8 See more

deepflow kubesphere-stable 6.2.606

1 of the 8 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
deepflowce/deepflow-app :v6.2.6.5	a1888d35e787	pip@22.0.4	26.0

Open the chart page →

18,394

pulsarkubesphere-stable

2.7.13

1 of 3 See more

pulsar kubesphere-stable 2.7.13

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
streamnative/apache-pulsar-grafana-dashboard-k8s :0.0.16	11bceacec8fb	pip@20.0.2 python-pip@20.0.2-5ubuntu1.5	26.0 no fix listed

Open the chart page →

14,368

online-boutiquekubesphere-test

0.1.0

2 of 11 See more

online-boutique kubesphere-test 0.1.0

2 of the 11 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
gcr.io/google-samples/microservices-demo/loadgenerator :v0.2.3	360130ab5850	pip@21.0.1	26.0
gcr.io/google-samples/microservices-demo/recommendationservice :v0.2.3	5f60c4988859	pip@21.0.1	26.0

Open the chart page →

26,019

sample-bookinfokubesphere-test

1.0.0

1 of 4 See more

sample-bookinfo kubesphere-test 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
kubesphere/examples-bookinfo-productpage-v1 :1.13.0	378f49ec9c44	pip@19.1.1	26.0

Open the chart page →

9,384

kubestellar-consolekubestellar-console

0.3.41

1 of 2 See more

kubestellar-console kubestellar-console 0.3.41

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
alpine/k8s :1.32.4	7e1e7d5b7a96	pip@25.1	26.0

Open the chart page →

4,440

kubevoipkubevoip

0.6.8

1 of 1 See more

kubevoip kubevoip 0.6.8

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/kubevoip/kubevoip :v0.6.8	41c603a93642	pip@25.0.1	26.0

Open the chart page →

1,087

kube-wordpress-mysqlkube-wordpress-mysql

0.1.0

1 of 2 See more

kube-wordpress-mysql kube-wordpress-mysql 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.0

Open the chart page →

8,634

kubiya-runnerkubiya-helm-charts

0.9.4

2 of 9 See more

kubiya-runner kubiya-helm-charts 0.9.4

2 of the 9 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/kubiyabot/agent-manager :v0.4.13	757bdd779345	pip@24.0	26.0
ghcr.io/kubiyabot/sdk-py :v1.20.0	f108f49570cc	pip@23.1.2	26.0

Open the chart page →

20,299

kusionkusionstack

0.14.1

2 of 3 See more

kusion kusionstack 0.14.1

2 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
kusionstack/kusion :v0.14.0	126c8f0b0976	pip@22.0.2 python-pip@22.0.2+dfsg-1ubuntu0.5	26.0 no fix listed
library/mysql :8.0	7dcddc01f13b	pip@25.3	26.0

Open the chart page →

6,879

kvkkvkservice

0.1.0

1 of 4 See more

8,534

kyso-nbdimekyso

1.0.0

1 of 1 See more

2,765

large-systems-djangolarge-systems-django

1.0.0

1 of 1 See more

large-systems-django large-systems-django 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ha33ona/python :test	6affdfc644d0	pip@21.2.4	26.0

Open the chart page →

3,891

pageslatif-pages

1.0.0

1 of 3 See more

20,233

pageslavanya-pages

1.0.0

1 of 3 See more

20,233

homebridgelbenicio-community

0.1.15

1 of 1 See more

homebridge lbenicio-community 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
homebridge/homebridge :latest	77c685a40911	pip@24.0 python-pip@24.0+dfsg-1ubuntu1.3	26.0 no fix listed

Open the chart page →

2,203

jenkinsleechistest

2.7.1

1 of 2 See more

jenkins leechistest 2.7.1

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
kiwigrid/k8s-sidecar :0.1.193	170069ff0976	pip@20.2.2	26.0

Open the chart page →

4,434

legendlegend

0.1.2

1 of 1 See more

4,067

owntracks-exporterleprechaun-charts

0.1.11

1 of 1 See more

owntracks-exporter leprechaun-charts 0.1.11

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/leprechaun/owntracks-exporter :0.1.11-de545066	099e1abd6d08	pip@23.2.1	26.0

Open the chart page →

3,448

delugelib42

1.3.0

1 of 1 See more

898

librenmslibrenms

10.1.1

1 of 5 See more

3,139

lightlyticslightlytics

0.1.21

2 of 2 See more

lightlytics lightlytics 0.1.21

2 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
public.ecr.aws/k6v9y5g3/cluster-agent :master.575	36d051110158	pip@24.3.1	26.0
public.ecr.aws/k6v9y5g3/cluster-agent :cost_k8s_process.576	9e14a72b066d	pip@24.3.1	26.0

Open the chart page →

5,130

delugelinkding

0.2.3

1 of 1 See more

deluge linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
linuxserver/deluge :libtorrentv1-2.2.0-ls40	052eac68ccc0	pip@25.1.1	26.0

Open the chart page →

1,432

linkdinglinkding

0.2.3

1 of 1 See more

linkding linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
sissbruecker/linkding :1.41.0-plus	a222fb777e1f	pip@25.1.1	26.0

Open the chart page →

37,518

calendar-apiliturgical

0.1.5

1 of 1 See more

calendar-api liturgical 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/liturgical-app/calendar-api :0.0.9	688a685e2bde	pip@25.0.1	26.0

Open the chart page →

1,557

liturgical-apiliturgical

0.2.11

1 of 1 See more

liturgical-api liturgical 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/liturgical-app/liturgical-api :1.0.12	637bdcebdd8d	pip@25.0.1	26.0

Open the chart page →

1,004

liturgical-appliturgical

0.9.0

1 of 1 See more

liturgical-app liturgical 0.9.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
ghcr.io/liturgical-app/liturgical-app :1.2.0	41f25aded572	pip@25.0.1	26.0

Open the chart page →

953

pagesliviu884422-pages

1.0.0

1 of 3 See more

20,233

llmarinerllmariner

1.53.1

1 of 21 See more

llmariner llmariner 1.53.1

1 of the 21 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
public.ecr.aws/cloudnatix/llmariner/model-manager-loader :1.27.0	26ac7263a823	pip@25.0.1	26.0

Open the chart page →

12,034

lnbitslnbits

0.2.1

1 of 1 See more

lnbits lnbits 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
lnbitsdocker/lnbits-legend :0.10.6	a11aaa6d2b21	pip@23.0.1	26.0

Open the chart page →

1,949

local-businesslocal-business

0.1.0

1 of 1 See more

local-business local-business 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
alakaganaguathoork/local-business :latest	7eb27b0f4a5a	pip@25.0.1	26.0

Open the chart page →

947

weather-app-chartlocal-weatherapp

0.1.0

1 of 4 See more

weather-app-chart local-weatherapp 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
youssef11gaber10/deployment-weather-flask :latest	96bce8b8b5a7	pip@23.0.1	26.0

Open the chart page →

5,905

locust-pluginslocust-plugins

0.0.4

1 of 3 See more

locust-plugins locust-plugins 0.0.4

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
locustio/locust :2.24.1	51d866285170	pip@24.0	26.0

Open the chart page →

7,516

nightingalelogic3579

0.3.1

2 of 6 See more

nightingale logic3579 0.3.1

2 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
flashcatcloud/nightingale :8.5.1	421acb36181b	pip@25.3	26.0
library/mysql :5.7	4bc6bc963e6d	pip@23.0.1	26.0

Open the chart page →

9,021

apica-ascentlogiqai

2.0.4

1 of 19 See more

apica-ascent logiqai 2.0.4

1 of the 19 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
logiqai/toolbox :2.0.1	55a574ec5b64	pip@18.1	26.0

Open the chart page →

23,255

lsdisklsdisk

2.0.7

1 of 4 See more

lsdisk lsdisk 2.0.7

1 of the 4 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
danialnabiyan1382/lsdisk :v2.0.8	f96a7ebf1f42	pip@25.2	26.0

Open the chart page →

5,032

alert-stream-schema-registrylsst-sqre

2.1.0

1 of 1 See more

alert-stream-schema-registry lsst-sqre 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
lsstdm/lsst_alert_packet :tickets-DM-32743	74c97a490940	pip@21.2.4	26.0

Open the chart page →

2,293

alert-stream-simulatorlsst-sqre

1.6.2

1 of 1 See more

alert-stream-simulator lsst-sqre 1.6.2

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
lsstdm/alert-stream-simulator :v1.2.1	973df082d006	pip@21.2.4	26.0

Open the chart page →

2,089

exposureloglsst-sqre

0.2.1

1 of 1 See more

exposurelog lsst-sqre 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
lsstsqre/exposurelog :0.8.0	79b00fb67a65	pip@22.0.3	26.0

Open the chart page →

2,078

kafka-aggregatorlsst-sqre

0.1.2

1 of 1 See more

kafka-aggregator lsst-sqre 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
lsstsqre/kafkaaggregator :master	be1b21060854	pip@21.0.1	26.0

Open the chart page →

3,052

narrativeloglsst-sqre

0.1.0

1 of 1 See more

narrativelog lsst-sqre 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
lsstsqre/narrativelog :0.1.0	ce01de04ce21	pip@22.0.3	26.0

Open the chart page →

1,638

nubladolsst-sqre

0.9.23

3 of 5 See more

nublado lsst-sqre 0.9.23

3 of the 5 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
lsstsqre/prepuller :latest	19c2dfc4e4ff	pip@21.0.1	26.0
lsstsqre/sciplat-hub :latest	5e0ade6bed1c	pip@21.0.1	26.0
lsstsqre/wfdispatcher :latest	e9feb99f524d	pip@21.0.1	26.0

Open the chart page →

5,787

nublado2lsst-sqre

0.8.5

1 of 2 See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
lsstsqre/nublado2 :2.0.1	b75bf8aaafa4	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	26.0 no fix listed

Open the chart page →

17,836

sasquatchlsst-sqre

0.1.13

2 of 6 See more

sasquatch lsst-sqre 0.1.13

2 of the 6 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
lsstsqre/kafkaconnect :0.9.3	4143c7cd705e	pip@21.3.1	26.0
lsstsqre/strimzi-registry-operator :0.4.1	e139fde946d7	pip@21.2.4	26.0

Open the chart page →

9,332

squash-apilsst-sqre

0.1.6

1 of 3 See more

squash-api lsst-sqre 0.1.6

1 of the 3 container images this version deploys carry CVE-2026-1703.

Container image	Digest	Package	Fixed in
lsstsqre/squash-api :0.5.3	4879415ec6ac	pip@20.3.2	26.0

Open the chart page →

6,623

Container images carrying it

1,190 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
eclipseaerios/hlo-allocator :v3.0.0	3cc1d94cfe96	pip@23.0.1	26.0	1
eclipseaerios/hlo-data-aggregator :v3.0.0	b433c2b9f5dc	pip@23.0.1	26.0	1
eclipseaerios/hlo-deployment-engine :v3.0.0	d582d39208c7	pip@23.0.1	26.0	1
eclipseaerios/hlo-fe-engine :v3.0.0	8ed2df4ca692	pip@23.0.1	26.0	1
eclipseaerios/iota-messages-api :latest	e7f5ba0bc64d	pip@23.0.1	26.0	1
eclipseaerios/self-awareness-hardware-info :1.4.4	34b72f45b46a	pip@25.2	26.0	1
eclipseaerios/self-awareness-power-consumption :1.3.3	c8af377c709f	pip@25.2	26.0	1
eclipseaerios/trust-manager :1.0.0	f55442e2c0ed	pip@23.0.1	26.0	1
elastichq/elasticsearch-hq :latest	bb3bd22c2b87	pip@18.1	26.0	1
elautoestopista/aeneabot :4.2.1	125ba620d528	pip@25.0.1	26.0	1
elautoestopista/raponchi :0.3.0	b6f74db9fc81	pip@24.0	26.0	1
elyra/kernel-image-puller :3.2.2	c922f1f1646a	pip@22.3.1	26.0	1
erenozcan17/flask_analytics :v3.1	c9b6f0dfbffc	pip@24.0	26.0	1
errbotio/errbot :6.1.9	00ee4e0953ab	pip@22.0.4	26.0	1
esailors/aws-ecr-http-proxy :1.5.1	5608ae045fa7	pip@22.1	26.0	1
esphome/esphome :1.18.0	3f51ec10e823	pip@18.1	26.0	1
esphome/esphome :2024.3.0	9ab8cc88b28c	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.0 no fix listed	1
esphome/esphome :2024.12.2	b2c6322700ac	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.0 no fix listed	1
esphome/esphome :2025.3.0	def8b6e4f517	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.0 no fix listed	1
evgkrsk/postgres-controller :0.6.2	37f0e1f435c3	pip@23.0	26.0	1
evk02/mlflow :2.2.1	ef6ff257ef35	pip@22.0.4	26.0	1
factly/hunting :0.2.0-stagv1.2	ca5bc71d1d5c	pip@22.3.1	26.0	1
felipecs8/app-db-connection-test :v1	29e06c9c6385	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.0 no fix listed	1
fiware/bae-activation-service :v0.0.3	3e3ec88d59ed	pip@10.0.1	26.0	1
fiware/biz-ecosystem-charging-backend :11.7.0	29456835bb2c	pip@20.0.2 python-pip@20.0.2-5ubuntu1.11	26.0 no fix listed	1
fiware/ishare-satellite :1.2.0	c3c1c8ccfb45	pip@22.0.4	26.0	1
flag5/clustersecret :0.0.9	4ad5748bfcc6	pip@21.2.4	26.0	1
flagsmith/flagsmith-api :v2.6.0	fd58556339a4	pip@21.0.1	26.0	1
flanksource/batch-runner :v1.0.44	689687a7cf95	pip@25.2	26.0	1
flashcatcloud/nightingale :8.5.1	421acb36181b	pip@25.3	26.0	1
flyway/flyway :9.15	45b5d7cdc75a	pip@20.0.2 python-pip@20.0.2-5ubuntu1.8	26.0 no fix listed	1
flyway/flyway :9.14.1-alpine	80f12c80502b	pip@22.3.1	26.0	1
forchaladtest/testwebapp :0.1	5909cf64ef53	pip@20.0.2	26.0	1
fossology/fossology :4.2.1	8bd1f22ba7bb	pip@18.1	26.0	1
foundationdb/foundationdb-kubernetes-sidecar :6.3.23-1	07e0ae17a7ca	pip@19.3.1	26.0	1
foundationdb/foundationdb-kubernetes-sidecar :6.2.30-1	9ceb2f948c9f	pip@21.0.1	26.0	1
foundationdb/foundationdb-kubernetes-sidecar :7.1.38-1	da1ee2731024	pip@19.3.1	26.0	1
frankescobar/allure-docker-service :2.21.0	8a4d7e9308de	pip@21.3.1 python-pip@9.0.1-2.3~ubuntu1.18.04.6	26.0 no fix listed	1
frankescobar/allure-docker-service :2.19.0	cafa03b94dac	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.5	26.0 no fix listed	1
freedom98/flask :k3.0	d7ce1533f297	pip@21.2.3	26.0	1
galaxy/cloudman-server :latest	e5c265fe9fcd	pip@20.0.2 python-pip@20.0.2-5ubuntu1.6	26.0 no fix listed	1
galaxy/galaxy-init :v18.01	0267bad550e6	pip@10.0.1 python-pip@1.5.4-1ubuntu4	26.0 no fix listed	1
galaxy/galaxy-stable :v18.01	8e577a626dfd	pip@1.5.4 python-pip@1.5.4-1ubuntu4	26.0 no fix listed	1
galaxy/pulsar-kubernetes :0.15.7	e50a890e24c9	pip@23.0.1 python-pip@23.0.1+dfsg-1	26.0 no fix listed	1
genseb/rabbitmq-producer-randomizer :0.0.6	cb7599641099	pip@23.1.2	26.0	1
geonode/geoserver :2.28.4-latest	81b1d431b7e9	pip@22.0.2 python-pip@22.0.2+dfsg-1ubuntu0.7	26.0 no fix listed	1
geopython/pycsw :3.0.0-beta2	84662ea6b78b	pip@25.3	26.0	1
geoscienceaustralia/dea-k8s-data :latest	f4039b45572a	pip@20.2.3 python-pip@9.0.1-2.3~ubuntu1.18.04.2	26.0 no fix listed	1
gethue/hue :4.11.0	11b649636e68	pip@22.2.2 python-pip@20.0.2-5ubuntu1.6	26.0 no fix listed	1
gethue/hue :4.10.0	5702b2c37ff9	pip@21.1.2 python-pip@9.0.1-2.3~ubuntu1.18.04.5	26.0 no fix listed	1