CVE-2026-23954
High · 8.7Incus container image templating arbitrary host file read and write
CVSS
8.7
EPSS
0.8%
Published
Jan 22, 2026
CISA due date
—
The record
A user with the ability to launch a container with a custom image (e.g a member of the ‘incus’ group) can use directory traversal or symbolic links in the templating functionality to achieve host arbitrary file read, and host arbitrary file write, ultimately resulting in arbitrary command execution on the host. This can also be exploited in IncusOS.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/lxc/incus | 0 | No fix |
| Go | github.com/lxc/incus/v6 | 6.1.0 | No fix |
| Go | github.com/lxc/incus/v6/cmd/incusd | 0 | No fix |
| Go | github.com/lxc/incus/v6/cmd/incusd | 6.1.0 | No fix |
| go | github.com/lxc/incus/v6/cmd/incusd | 6.1.0 | No fix |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
| openSUSE:Tumbleweed | incus | 0 | 6.22-1.1 |
Related vulnerabilities
- GO-2026-4357 Incus container image templating arbitrary host file read and write in… Same vulnerability
- GO-2026-4359 Incus container environment configuration newline injection in github.com/lxc/incus Also affects github.com/lxc/incus
- CVE-2026-23953 Incus container environment configuration newline injection Also affects github.com/lxc/incus
- GO-2025-4115 Incus vulnerable to local privilege escalation through custom storage volumes in… Also affects github.com/lxc/incus
- CVE-2025-64507 Incus vulnerable to local privilege escalation through custom storage volumes Also affects github.com/lxc/incus
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
- CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb