The vulnerability is an improper limitation of a pathname that allows path traversal. Based on the description, it is inferred that an attacker who can mount a man‑in‑the‑middle on the iSCSI discovery process can create, modify, or delete files outside the intended database directory as the root user. This root‑owned file write can be leveraged to inject malicious configuration or execute arbitrary code, thereby compromising integrity and confidentiality of the system.

The affected product is open-iscsi from the open-iscsi package. All releases up to and including the commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e are vulnerable. This includes any version that contains the code before the commit that fixes the path handling.

The CVSS score of 6.9 indicates a medium severity but the EPSS score of < 1% shows that exploitation is currently considered unlikely. The likely attack vector is an adversary positioning themselves in the iSCSI discovery network path, which might be limited to trusted internal networks. Because the flaw enables the creation of root‑owned files, it carries a high impact if an adversary succeeds.