{"cve":"CVE-2018-16849","nvd":{"published":"2018-11-02T21:29:00.323","modified":"2026-06-17T01:44:54.327","status":"Modified","description":"A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-200"],"references":["https://bugs.launchpad.net/mistral/+bug/1783708","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16849","https://bugs.launchpad.net/mistral/+bug/1783708","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16849"],"products":["redhat:openstack-mistral"],"source":"nvd","synced_at":"2026-10-19T20:53:59.789560037+00:00"},"epss":{"cve":"CVE-2018-16849","score":0.0152,"percentile":0.74592,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-fqw7-c6vr-q29m","url":"https://osv.dev/vulnerability/GHSA-fqw7-c6vr-q29m","summary":"openstack-mistral Discloses the presence of arbitrary files within the filesystem","modified":"2024-09-24T21:23:07.055760Z","packages":[{"ecosystem":"PyPI","name":"mistral","purl":"pkg:pypi/mistral","ranges":["<7.0.1"],"fixed":["7.0.1"]}]},{"id":"PYSEC-2018-92","url":"https://osv.dev/vulnerability/PYSEC-2018-92","summary":"","modified":"2026-06-10T17:02:16.107502106Z","packages":[{"ecosystem":"PyPI","name":"mistral","purl":"pkg:pypi/mistral","ranges":["<7.0.1"],"fixed":["7.0.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}