DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-PJFF-C2WC-F6JM: CVE-2026-48769: Arbitrary File Write and Remote Code Execution via Trusted Image Hash in Canonical LXD…

#security #cve #cybersecurity

CVE-2026-48769: Arbitrary File Write and Remote Code Execution via Trusted Image Hash in Canonical LXD and Linux Containers Incus

Vulnerability ID: GHSA-PJFF-C2WC-F6JM
CVSS Score: 9.9
Published: 2026-11-06

A critical path traversal vulnerability caused by improper input validation (CWE-20) exists in the direct image download handler of Canonical LXD and Linux Containers Incus. When an authenticated user requests an image import using the URL source type, the daemon reads the image fingerprint from an untrusted HTTP response header (Incus-Image-Hash or LXD-Image-Hash) without validating that it conforms to a SHA-256 format. This unvalidated string is concatenated directly into a filesystem path via filepath.Join prior to file creation and cryptographic verification, allowing directory traversal sequences to write arbitrary files on the host filesystem as root.

TL;DR

Canonical LXD and Linux Containers Incus fail to validate the Incus-Image-Hash and LXD-Image-Hash HTTP headers during URL-based image imports. Attackers with low-privilege API access can supply path traversal sequences in this header to write arbitrary files as root on the host filesystem (such as /etc/cron.d/), resulting in full host remote code execution.

⚠️ Exploit Status: POC

Technical Details

  • CVE ID: CVE-2026-48769 (GHSA-pjff-c2wc-f6jm / GHSA-f6m5-xw2g-xc4x)
  • Weakness Class: CWE-20 (Improper Input Validation / Path Traversal)
  • CVSS v3.1 Score: 9.9 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
  • Attack Vector: Network / Authenticated API (POST /1.0/images with source.type=url)
  • Impact: Arbitrary Host File Write and Remote Code Execution as root
  • Exploit Status: Public Proof-of-Concept (PoC) Available
  • EPSS Score: 0.78% (56.21st Percentile)
  • CISA KEV Status: Not Listed

Affected Systems

  • Canonical LXD
  • Linux Containers Incus
  • Incus: < 7.2.0 (Fixed in: 7.2.0)
  • LXD: >= 4.0.0, < 4.0.11 (Fixed in: 4.0.11)
  • LXD: >= 5.0.0, < 5.0.7 (Fixed in: 5.0.7)
  • LXD: >= 5.1.0, < 5.21.5 (Fixed in: 5.21.5)
  • LXD: >= 6.0.0, < 6.9.0 (Fixed in: 6.9.0)

Exploit Details

Mitigation Strategies

  • Upgrade Linux Containers Incus and Canonical LXD packages to the patched release versions across all container hosts.
  • Restrict access to the Incus and LXD local Unix domain sockets and remote HTTPS APIs (port 8443) to trusted host administrators only.
  • Enforce strict outbound egress firewall policies on container hosts to prevent the Incus/LXD daemon from connecting to untrusted HTTP/HTTPS endpoints.
  • Monitor host filesystem integrity in critical directories such as /etc/cron.d/, /etc/systemd/system/, and /root/.ssh/ for unauthorized file creation.

Remediation Steps:

  1. Identify all hosts running Incus (< 7.2.0) or Canonical LXD (< 4.0.11, < 5.0.7, < 5.21.5, < 6.9.0).
  2. For Incus installations, update the incus package to version 7.2.0 or later via the distribution package manager.
  3. For Canonical LXD installations managed via Snap or system packages, refresh or upgrade to 4.0.11, 5.0.7, 5.21.5, or 6.9.0 depending on the active channel.
  4. Verify the running daemon version using 'incus version' or 'lxc version' and restart the service if required.
  5. Review /etc/cron.d/ and system logs on previously exposed multi-tenant hosts for any indicators of transient file creation or unauthorized image import attempts.

References

Read the full report for GHSA-PJFF-C2WC-F6JM on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)