GHSA-83xr-5xxr-mh92 CVE-2026-33897 GO-2026-4881
Incus vulnerable to arbitrary file read and write through pongo templates
- Severity
- 9.9 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 0.49%
- Chance of exploitation in the next 30 days. Higher than 42.12% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
- Fix
6.23.0- Upgrade github.com/lxc/incus/v6 to this version or later
Description
Summary
Instance template files can be used to cause arbitrary read or writes as root on the host server.
Details
Incus allows for pongo2 templates within instances which can be used at various times in the instance lifecycle to template files inside of the instance. This particular implementation of pongo2 within Incus allowed for file read/write but with the expectation that the pongo2 chroot feature would isolate all such access to the instance's filesystem.
This was allowed such that a template could theoretically read a file and then generate a new version of said file.
Unfortunately the chroot isolation mechanism is entirely skipped by pongo2 leading to easy access to the entire system's filesystem with root privileges.
Credit
This issue was discovered and reported by the team at 7asecurity
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/lxc/incus | <= 0.7.0 |
No fix yet |
| github.com/lxc/incus | all versions |
No fix yet |
| github.com/lxc/incus/v6 | < 6.23.0 |
6.23.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/lxc/incus/v6 Go → 6.23.0
- go
go get github.com/lxc/incus/v6@v6.23.0 && go mod tidy
Severity breakdown
CVSS 3.1 9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
How to prevent it
- Architecture and Design: Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.
- Implementation: Use the template engine's sandbox or restricted mode, if available.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GO-2026-6319 Incus has a project restriction bypass in instance copy across projects | High | Also affects github.com/lxc/incus |
| GHSA-64f3-v33m-w89f Incus has a project restriction bypass for custom volume copy across projects | High | Also affects github.com/lxc/incus |
| GO-2026-5806 Incus has an arbitrary file write on its client due to trusted image hash | Critical | Also affects github.com/lxc/incus |
| GO-2026-5810 Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) | Low | Also affects github.com/lxc/incus |
| GO-2026-5808 Incus has an argument injection in backup compression algorithm leading to AFW and ACE | Critical | Also affects github.com/lxc/incus |
| GO-2026-5800 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} | Low | Also affects github.com/lxc/incus |
| GO-2026-5802 Incus has an arbitrary file write via path traversal in S3 multipart upload | Critical | Also affects github.com/lxc/incus |
| GO-2026-5803 Incus has arbitrary file read+write on host via templates/ symlink in malicious image | Critical | Also affects github.com/lxc/incus |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor