« Volver al listado

CVE-2026-23954

Estado: AnalizadaAlta (8.7)—

Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with a custom image (e.g a member of the ‘incus’ group) to use directory traversal or symbolic links in the templating functionality to achieve host arbitrary file read, and host arbitrary file write. This ultimately results in arbitrary command execution on the host. When using an image with a metadata.yaml containing templates, both the source and target paths are not checked for symbolic links or directory traversal. This can also be exploited in IncusOS. A fix is planned for versions 6.0.6 and 6.21.0, but they have not been released at the time of publication.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:A + PR:L indica red adyacente con privilegios locales (miembro del grupo 'incus'). Traversal y symlinks en templating permiten lectura/escritura arbitraria en host y ejecución de comandos remota.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based Content

Tecnologías afectadas (1)

Linuxcontainers — Incus

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-23954",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-23954",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-26T21:02:38.599423Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.7,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "lxc",
          "product": "incus",
          "versions": [
            {
              "status": "affected",
              "version": ">= 6.1.0, <= 6.20.0"
            },
            {
              "status": "affected",
              "version": "<= 6.0.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-22T22:16:20.833",
  "references": [
    {
      "url": "https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L7215",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L7294",
      "tags": [
        "Product"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/lxc/incus/security/advisories/GHSA-7f67-crqm-jgh7",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/user-attachments/files/24473599/template_arbitrary_write.sh",
      "tags": [
        "Exploit"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/user-attachments/files/24473601/templates_arbitrary_write.patch",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with a custom image (e.g a member of the ‘incus’ group) to use directory traversal or symbolic links in the templating functionality to achieve host arbitrary file read, and host arbitrary file write. This ultimately results in arbitrary command execution on the host. When using an image with a metadata.yaml containing templates, both the source and target paths are not checked for symbolic links or directory traversal. This can also be exploited in IncusOS. A fix is planned for versions 6.0.6 and 6.21.0, but they have not been released at the time of publication."
    },
    {
      "lang": "es",
      "value": "Incus es un gestor de contenedores de sistema y máquinas virtuales. Las versiones 6.21.0 e inferiores permiten a un usuario con la capacidad de lanzar un contenedor con una imagen personalizada (por ejemplo, un miembro del grupo 'incus') utilizar salto de directorio o enlaces simbólicos en la funcionalidad de plantillas para lograr la lectura arbitraria de archivos del host y la escritura arbitraria de archivos del host. Esto finalmente resulta en la ejecución arbitraria de comandos en el host. Al usar una imagen con un metadata.yaml que contiene plantillas, ni las rutas de origen ni las de destino se verifican en busca de enlaces simbólicos o salto de directorio. Esto también puede ser explotado en IncusOS. Se planea una corrección para las versiones 6.0.6 y 6.21.0, pero no han sido lanzadas en el momento de la publicación."
    }
  ],
  "lastModified": "2026-06-17T10:22:20.753",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0DF87DBE-86FF-4E74-8086-AE3360A94C71",
              "versionEndIncluding": "6.0.5"
            },
            {
              "criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47AA575C-385C-4C34-8CC0-F370EC4ED7B4",
              "versionEndExcluding": "6.21.0",
              "versionStartIncluding": "6.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}