GHSA-pjff-c2wc-f6jm: LXD has arbitrary file write on client due to trusted image hash

November 6, 2026

An arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server.

References

github.com/advisories/GHSA-pjff-c2wc-f6jm
github.com/canonical/lxd/security/advisories/GHSA-pjff-c2wc-f6jm
github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x
nvd.nist.gov/vuln/detail/CVE-2026-48769

Code Behaviors & Features

Detect and mitigate GHSA-pjff-c2wc-f6jm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →