{
  "id": 18653539,
  "title": "GHSA-PJFF-C2WC-F6JM: CVE-2026-48769: Arbitrary File Write and Remote Code Execution via Trusted Image Hash in Canonical LXD…",
  "url": "https://urgent.news/2026/11/07/ghsa-pjff-c2wc-f6jm-cve-2026-48769-arbitrary-file-write-and-remote",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-07T06:31:19.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cverports/ghsa-pjff-c2wc-f6jm-cve-2026-48769-arbitrary-file-write-and-remote-code-execution-via-trusted-4al8"
  },
  "original_language": "en",
  "account": null,
  "summary": "CVE-2026-48769 is a critical path traversal vulnerability affecting Canonical LXD and Linux Containers Incus, allowing arbitrary file write and remote code execution via a trusted image hash. This vulnerability exists due to improper input validation in the direct image download handler, specifically when an authenticated user requests an image import using the URL source type. The daemon reads the image fingerprint from an untrusted HTTP response header, concatenating it directly into a filesystem path without proper validation. Attackers can exploit this by supplying path traversal sequences in the Incus-Image-Hash or LXD-Image-Hash headers, enabling them to write arbitrary files on the host filesystem as root and execute arbitrary code remotely. The vulnerability has a high CVSS score of 9.9 and is considered critical. Affected versions include LXD 4.0.0, 4.0.11, 5.0.0, 5.0.7, 5.1.0, 5.21.5, and 6.9.0, as well as Incus versions up to 7.2.0. Users are advised to upgrade to the patched release versions and restrict access to Incus and LXD APIs to prevent exploitation.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}