PT-2026-6517 · Go · Github.Com/Lxc/Incus+1

Published 2026-02-05 · Updated 2026-02-05

OSV

Incus container image templating arbitrary host file read and write in github.com/lxc/incus

Related Identifiers

GO-2026-4357

Affected Products

Github.Com/Lxc/Incus

Github.Com/Lxc/Incus/V6

References · 7

• https://osv.dev/vulnerability/GO-2026-4357 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23954 · Security Note
• https://github.com/lxc/incus/security/advisories/GHSA-7f67-crqm-jgh7 · Note
• https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L7294 · Note
• https://github.com/lxc/incus/blob/HEAD/internal/server/instance/drivers/driver_lxc.go#L7215 · Note
• ❌ https://github.com/user-attachments/files/24473601/templates_arbitrary_write.patch · Note, Deleted
• ❌ https://github.com/user-attachments/files/24473599/template_arbitrary_write.sh · Note, Deleted