CVE-2026-23954

{"id": "CVE-2026-23954", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23954", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-26T21:02:38.599423Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": ">= 6.1.0, <= 6.20.0"}, {"status": "affected", "version": "<= 6.0.5"}]}]}], "published": "2026-01-22T22:16:20.833", "references": [{"url": "https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L7215", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L7294", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lxc/incus/security/advisories/GHSA-7f67-crqm-jgh7", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/user-attachments/files/24473599/template_arbitrary_write.sh", "tags": ["Exploit"], "source": "security-advisories@github.com"}, {"url": "https://github.com/user-attachments/files/24473601/templates_arbitrary_write.patch", "tags": ["Patch"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with a custom image (e.g a member of the \u2018incus\u2019 group) to use directory traversal or symbolic links in the templating functionality to achieve host arbitrary file read, and host arbitrary file write. This ultimately results in arbitrary command execution on the host. When using an image with a metadata.yaml containing templates, both the source and target paths are not checked for symbolic links or directory traversal. This can also be exploited in IncusOS. A fix is planned for versions 6.0.6 and 6.21.0, but they have not been released at the time of publication."}, {"lang": "es", "value": "Incus es un gestor de contenedores de sistema y m\u00e1quinas virtuales. Las versiones 6.21.0 e inferiores permiten a un usuario con la capacidad de lanzar un contenedor con una imagen personalizada (por ejemplo, un miembro del grupo 'incus') utilizar salto de directorio o enlaces simb\u00f3licos en la funcionalidad de plantillas para lograr la lectura arbitraria de archivos del host y la escritura arbitraria de archivos del host. Esto finalmente resulta en la ejecuci\u00f3n arbitraria de comandos en el host. Al usar una imagen con un metadata.yaml que contiene plantillas, ni las rutas de origen ni las de destino se verifican en busca de enlaces simb\u00f3licos o salto de directorio. Esto tambi\u00e9n puede ser explotado en IncusOS. Se planea una correcci\u00f3n para las versiones 6.0.6 y 6.21.0, pero no han sido lanzadas en el momento de la publicaci\u00f3n."}], "lastModified": "2026-06-17T10:22:20.753", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0DF87DBE-86FF-4E74-8086-AE3360A94C71", "versionEndIncluding": "6.0.5"}, {"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47AA575C-385C-4C34-8CC0-F370EC4ED7B4", "versionEndExcluding": "6.21.0", "versionStartIncluding": "6.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}