CVE-2026-23954
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-30
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linuxcontainers | incus | to 6.0.5 (inc) |
| linuxcontainers | incus | From 6.1.0 (inc) to 6.21.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Incus (versions 6.21.0 and below) allows a user who can launch a container with a custom image (such as a member of the 'incus' group) to exploit directory traversal or symbolic links in the templating functionality. This flaw enables the user to read and write arbitrary files on the host system, ultimately leading to arbitrary command execution on the host. The issue arises because the source and target paths in the image's metadata.yaml templates are not checked for symbolic links or directory traversal.
How can this vulnerability impact me? :
This vulnerability can have a severe impact as it allows an attacker with limited privileges (able to launch containers with custom images) to execute arbitrary commands on the host system. This can lead to unauthorized access, data manipulation, or disruption of services on the host, compromising the security and integrity of the system.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting the ability to launch containers with custom images to trusted users only (e.g., limiting membership of the 'incus' group), avoiding use of images with untrusted or unverified metadata.yaml templates, and monitoring for any suspicious activity related to container templating. Since a fix is planned but not yet released, applying updates once available is critical.