This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-55748 →

DEBIAN-CVE-2026-55748

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOT...

Original description

The description as published by the source.

OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a vulnerability.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 horizon

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:23.0.0-5+deb12u2"}]}]

Debian:13 horizon

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:25.3.0-3+deb13u1"}]}]

Debian:14 horizon

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:25.7.3-2"}]}]

References

advisory security-tracker.debian.org