Fluid Attacks Database

Description

Incus container image templating arbitrary host file read and write in github.com/lxc/incus Incus container image templating arbitrary host file read and write in github.com/lxc/incus

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
go	github.com/lxc/incus/v6	>=6.1.0	-
go	github.com/lxc/incus	-	-
debian 13	lxd	=5.0.2+git20231211.1364ae4-9 \|\| =5.0.2+git20231211.1364ae4-9+deb13u1 \|\| =5.0.2+git20231211.1364ae4-9+deb13u2 \|\| >=0 <5.0.2+git20231211.1364ae4-9+deb13u3	5.0.2+git20231211.1364ae4-9+deb13u3
debian 13	incus	=6.0.4-2 \|\| =6.0.4-2+deb13u1 \|\| =6.0.4-2+deb13u1~bpo12+1 \|\| =6.0.4-2+deb13u2 \|\| =6.0.4-2+deb13u2~bpo12+1 \|\| =6.0.4-2+deb13u3 \|\| =6.0.4-2+deb13u3~bpo12+1 \|\| =6.0.4-2+deb13u4~bpo12+1 \|\| >=0 <6.0.4-2+deb13u4	6.0.4-2+deb13u4
debian 14	incus	=6.0.4-2 \|\| =6.0.4-3 \|\| =6.0.5-1 \|\| =6.0.5-2 \|\| =6.0.5-3 \|\| =6.0.5-4 \|\| =6.0.5-5 \|\| =6.0.5-6 \|\| =6.0.5-7 \|\| >=0 <6.0.5-8	6.0.5-8
go	github.com/lxc/incus/v6/cmd/incusd	>=0 <6.21.0	6.21.0
debian 12	lxd	=5.0.2-5 \|\| =5.0.2-5+deb12u1 \|\| =5.0.2-5+deb12u2 \|\| >=0 <5.0.2-5+deb12u3	5.0.2-5+deb12u3

Aliases

1. CVE-2026-239542. NVD-2026-239543. OSV-GO-2026-43574. OSV-2026-239545. OSV-DEBIAN-2026-239546. GHSA-7f67-crqm-jgh77. GCVE-2026-239548. GHSA-7f67-crqm-jgh79. SECURITY-TRACKER-CVE-2026-23954

References

1. https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L72152. https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L72943. https://github.com/user-attachments/files/24473599/template_arbitrary_write.sh4. https://github.com/user-attachments/files/24473601/templates_arbitrary_write.patch5. https://github.com/lxc/incus/security/advisories/GHSA-7f67-crqm-jgh7