Urgent.News

What's breaking now, across thousands of outlets.

Saturday, 7 November 2026 Reading Room

Tech

GHSA-PJFF-C2WC-F6JM: CVE-2026-48769: Arbitrary File Write and Remote Code Execution via Trusted Image Hash in Canonical LXD…

CVE-2026-48769: Arbitrary File Write and Remote Code Execution via Trusted Image Hash in Canonical LXD and Linux Containers Incus Vulnerability ID: GHSA-PJFF-C2WC-F6JM CVSS Score: 9.9 Published: 2026-11-06 A critical path traversal vulnerability caused by improper input validation (CWE-20) exists in the direct image download handler of Canonical LXD and Linux Containers Incus. When an…

dev.to ·

CVE-2026-48769 is a critical path traversal vulnerability affecting Canonical LXD and Linux Containers Incus, allowing arbitrary file write and remote code execution via a trusted image hash. This vulnerability exists due to improper input validation in the direct image download handler, specifically when an authenticated user requests an image import using the URL source type.

The daemon reads the image fingerprint from an untrusted HTTP response header, concatenating it directly into a filesystem path without proper validation. Attackers can exploit this by supplying path traversal sequences in the Incus-Image-Hash or LXD-Image-Hash headers, enabling them to write arbitrary files on the host filesystem as root and execute arbitrary code remotely.

The vulnerability has a high CVSS score of 9.9 and is considered critical. Affected versions include LXD 4.0.0, 4.0.11, 5.0.0, 5.0.7, 5.1.0, 5.21.5, and 6.9.0, as well as Incus versions up to 7.2.0. Users are advised to upgrade to the patched release versions and restrict access to Incus and LXD APIs to prevent exploitation.

Brief written by urgent.news from Dev.to's own syndicated text. Machine-written — may contain errors; check the original before relying on it.

This story

This is one outlet's version. Read the fullest account.

Read the original at dev.to →

More in Tech

Why Filled PDF Forms Open Blank in Some Viewers (and How to Fix It)

If you build document workflows, web upload portals, or automated billing pipelines, you have likely run into this frustrating bug: a user fills out a PDF form, submits it, but when an administrator…

  • PDF forms have separate Field Dictionary and Widget Annotation layers
  • Blank boxes occur when values written without valid appearance streams
  • Form flattening converts interactive PDFs to static content streams

·dev.to

I replaced a brand's Shopify app stack with code. Here's what it really costs

The usual Shopify answer to "can the store do X?" is "there's an app for that". Install it, pay monthly, live with its widget, its script weight and its idea of how your store should look.

  • Publisher replaces third-party Shopify apps with custom code solutions
  • Custom code eliminates app limitations, maintains cohesive design

·dev.to

I Run 4 Coding Agents at Once: My Full Orchestration Setup

I Run 4 Coding Agents at Once: My Full Orchestration Setup Watch the video version here: I Run 4 Coding Agents at Once: My Full Orchestration Setup (8 minutes, 9 seconds).

  • Four coding agents run simultaneously under strict supervision.
  • Roles (refactoring, testing, building) are prioritized over models.
  • Tasks are structured as packets with goal, context, steps, output format, and verification.

·dev.to

More from Saturday 7 November →