PT-2026-49096 · Glance · Glance

Dungnhvhust + 1 · CVE-2026-53925 · Published 2026-06-13 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions glances (affected versions not specified)

Description The secure popen() function in glances/secure.py improperly interprets shell-like operators, specifically > (file redirection), | (pipe), and && (command chaining), within command strings. When Application Monitoring Process (AMP) modules load command or service cmd configuration values from glances.conf, these values are passed to secure popen() without sanitization. This allows an attacker who can modify the configuration file to write arbitrary content to any filesystem path, chain arbitrary commands, or pipe output to other programs.

Technical details include:

• Vulnerable Function: secure popen() parses the > operator to write to files via open(stdout redirect, "w") without path validation, and uses | and && to execute sequential or piped processes.
• Vulnerable Parameters: The command and service cmd configuration values loaded from [amp <name>] and [amp systemv] sections.

The --disable-config-exec flag does not mitigate this issue as it only prevents backtick execution in config.get value() and does not affect how secure popen() processes the resulting strings.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the glances.conf file to prevent unauthorized modification of AMP command and service cmd values. Avoid using the > , | , and && operators within the AMP configuration values.

Exploit

LPE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-53925

GHSA-3VWC-QWHC-3MJ7

OPENSUSE-SU-2026:11122-1

PYSEC-2026-2494

Affected Products

Glance

References · 25

• 🔥 https://github.com/nicolargo/glances/security/advisories/GHSA-3vwc-qwhc-3mj7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53925.json · Exploit
• https://cve.org/CVERecord?id=CVE-2026-53925 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2494 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-53925 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53925 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-53925 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11122-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53925 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-53925 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-53925 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3vwc-qwhc-3mj7 · Vendor Advisory
• https://github.com/nicolargo/glances · Note
• https://github.com/nicolargo/glances/releases/tag/v4.5.5 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/glances/PYSEC-2026-2494.yaml · Note