CVE-2021-4472 Python-mistralclient: mistral-dashboard: local file inclusion through the 'create workbook' feature
Attackers can read arbitrary local files via the Create Workbook feature in the Mistral Dashboard plugin for OpenStack.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-4472?
CVE-2021-4472 is a medium-severity path traversal vulnerability in Red Hat OpenStack Platform 13 (Queens), published on 26 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content.
Weakness: CWE-73
Which versions are affected by CVE-2021-4472?
3 open source packages ship an affected version, including python-mistralclient.
| Package | Affected | Fixed in |
|---|---|---|
python-mistralclient PyPI | All versions | 4.3.0 |
python-mistralclient PyPI | All versions | 4.3.0 |
python-mistralclient PyPI | All versions | 4.3.0 |
Linux distribution packages (1)
python-mistralclient openSUSE:Tumbleweed | All versions | 6.1.0-1.1 |
How do I fix CVE-2021-4472?
Upgrade python-mistralclient to 4.3.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-4472 being exploited?
There is no known exploitation of CVE-2021-4472 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2021-4472, DLA-4391-1, DLA-4392-1, GHSA-75hx-6r6j-hw56, PYSEC-2026-1849, UBUNTU-CVE-2021-4472 and 1 more.