A cross-site scripting (XSS) vulnerability exists in the traQ file retrieval API when using local storage. User-uploaded SVG or HTML files can be served in a way that allows arbitrary JavaScript execution in victims' browsers if they open a crafted file URL. The issue is fixed in version 1.0.0-rc.2.0.20260627142846-3db29e777166 by always adding a Content-Disposition header to prevent direct rendering. Workarounds include changing the storage backend or forcing file downloads via a query parameter.
A vulnerability in LXD (Incus) allows bypassing project restrictions that are intended to block low-level container operations. Specifically, instance snapshots ignore the 'restricted.containers.lowlevel=block' setting, enabling attackers to abuse low-level hooks like 'raw.lxc' and 'raw.qemu' to execute arbitrary commands on the host with root privileges. This can be exploited by crafting a malicious snapshot locally and restoring it in a restricted project on a remote server, resulting in full command execution on the Incus server.
LXD contains a vulnerability where missing authorization checks allow an attacker to copy a custom storage volume from a project they do not have access to into a project they control. This occurs because the source project field is attacker-controlled and not properly permission-checked before copying. Exploitation can lead to unauthorized access to secrets stored in custom volumes. A proof-of-concept script demonstrates how an attacker with valid credentials but restricted project access can copy volumes across projects on the same server.
A vulnerability in LXD allows an attacker with limited project access to copy instances from projects they are not authorized to access by exploiting missing authorization checks during instance copying. This can lead to unauthorized access to secrets contained within those instances. The flaw exists because the source instance is loaded without verifying the caller's permission to view it. A proof-of-concept script demonstrates how to copy an instance from a restricted project to another project. This issue is fixed in version 0.0.0-20260630083100-c5184be310b1.
CVE-2026-9639 is a vulnerability in the LXD daemon's CreateCustomVolumeFromBackup function where an unguarded dereference of a nil pointer occurs on the ExpiresAt field of volume snapshots in a custom volume backup. An authenticated user with permission to create storage volumes can crash the LXD daemon by uploading a crafted backup tarball missing the expires_at field in snapshots. This causes a panic in the Go runtime, resulting in a denial of service. The issue is fixed in commit 0.0.0-20260622081844-85f897013ccd.
A critical arbitrary file write vulnerability exists in the Incus (LXD) client when it processes a malicious image server's crafted Incus-Image-Hash header. This flaw allows an attacker to write files to arbitrary locations on the server filesystem, potentially leading to root command execution. The vulnerability arises because the client trusts the Incus-Image-Hash header before validating the downloaded image's SHA-256 hash, enabling directory traversal attacks. A proof-of-concept demonstrates writing to /etc/cron.d to achieve remote code execution. This issue is fixed in version 0.0.0-20260630083100-c5184be310b1.
LXD (Incus) contains a vulnerability in its backup compression algorithm handling that allows argument injection. The software validates only the first token of the user-supplied compression algorithm against an allowlist but does not reject extra arguments. This flaw enables an attacker to inject additional command-line arguments, leading to arbitrary file writes on the host system and potentially arbitrary command execution. A proof-of-concept demonstrates uploading a malicious cron job file via this injection. The vulnerability is rated critical with a CVSS score of 9.9 and has been patched in version 0.0.0-20260630083100-c5184be310b1.
A vulnerability in LXD allows a specially crafted container image with a malicious rootfs symlink to perform arbitrary file read and write operations on the host filesystem. This occurs because the image validation process does not properly handle duplicate top-level rootfs symlinks, enabling root-level access to the host. The flaw can lead to arbitrary command execution on the host system.
A vulnerability in LXD allows a specially crafted container image to read and write arbitrary files on the host system by exploiting a symlink named 'templates' in the image. This can lead to arbitrary command execution on the host. The flaw arises because the tar extraction process does not reject a top-level 'templates' symlink, enabling access to host directories such as /etc/cron.d. A proof of concept demonstrates creating a cron job on the host via this method. The vulnerability is critical with a CVSS score of 9.9 and has been fixed in version 0.0.0-20260203144152-d1c8ba15d160.
LXD contains a vulnerability where the 'exec-output' directory can be a symlink, allowing files to be written to arbitrary locations on the host. This can be exploited to create files such as cron jobs, enabling arbitrary command execution on the host system. The issue arises because top-level symlinks in unpacked images are preserved, and the code follows the symlink when writing output files. A proof-of-concept demonstrates placing a malicious file in /etc/cron.d to achieve code execution.
CVE-2026-28385 is a server-side request forgery (SSRF) vulnerability in the LXD image import-from-URL endpoint. Authenticated users with the can_create_images entitlement can cause the LXD daemon to make HTTP requests to arbitrary internal network addresses, including private IP ranges and loopback addresses, without any filtering or blocking. This enables internal network probing and port scanning from the daemon's privileged network position. The vulnerability also involves a chained SSRF via attacker-controlled response headers. The vulnerability has a medium severity with low confidentiality impact and no integrity or availability impact.
A SQL injection vulnerability in listmonk's GET /api/subscribers/export endpoint allows authenticated users with the subscribers:sql_query permission to bypass table access controls and read arbitrary database tables, including sensitive ones like users and settings. This enables exfiltration of bcrypt password hashes and SMTP credentials. The vulnerability also permits execution of data-modifying SQL statements via PostgreSQL CTEs. An attacker can escalate privileges by cracking extracted bcrypt hashes to take over Super Admin accounts. The flaw is fixed in version 1.1.1-0.20260619102436-c0a6525009a6.
A vulnerability in the osac-console-proxy component of the osac-operator allows remote code execution and server-side request forgery (SSRF). The console-proxy improperly processes kubeconfig data from Kubernetes Secrets without sanitizing exec plugin configurations, enabling execution of arbitrary processes with the proxy's service account privileges. This affects deployments using remote or auto VM cluster modes. A patch is available in version 0.0.4.
kaniko versions before 1.25.20 contain a vulnerability in the Azure Container Registry (ACR) credential helper that can cause it to send Microsoft Entra ID (Azure AD) access tokens to attacker-controlled lookalike registry hosts. This occurs when a Dockerfile references images from a hostname containing '.azurecr.io' or similar domains, allowing an attacker to receive live Azure Resource Manager tokens. The vulnerability is fixed in kaniko v1.25.20 by tightening hostname validation in the credential helper.
A vulnerability in LXD allows a guest container to mount and access another guest's custom storage volume without ownership. This occurs because the device-update path that attaches volumes to containers does not verify volume ownership, enabling tenants with the 'security.devlxd.management.volumes' permission to hijack volumes from other tenants within the same project. The flaw affects LXD versions prior to the fixed commit 0.0.0-20260626085133-7cb96ac80a6d and has a high severity CVSS score of 8.4.
A vulnerability in Arc's integration with DuckDB allows any authenticated user, even with no permissions, to bypass database role-based access control (RBAC) and read data across all tenant databases within the shared storage root. The issue arises because the sandbox configuration permits access to the entire multi-tenant storage root, and the RBAC checks do not inspect table-valued functions such as DuckDB's I/O aliases (e.g., parquet_scan). Additionally, the SQL denylist only blocks the literal function read_parquet, missing other aliases and related functions. This enables cross-database data exposure despite RBAC enforcement.
A path traversal vulnerability in praktor's Telegram file upload functionality allows remote users to write files outside the intended uploads/ directory within the agent's persistent workspace. This occurs because the Telegram document filename is not sanitized and is concatenated into the destination path, enabling directory traversal sequences. An attacker can overwrite or plant files that the agent later uses, potentially injecting malicious instructions or configurations. The vulnerability affects versions prior to 0.9.1 and requires no authentication by default. It is fixed in version 0.9.1.
A vulnerability in Netfoil versions 0.3.0 up to but not including 0.6.1 causes the TTL (Time To Live) value not to be decremented. This results in stale records continuing to be served beyond their intended lifetime.
Arc exposes an unauthenticated endpoint at GET /api/v1/logs that returns recent application logs without requiring authentication, despite authentication being enabled by default. This occurs because the route is registered before the global authentication middleware, causing the middleware to be bypassed. The logs can include operational metadata and potentially sensitive information, which could aid attackers. A fix is available that involves reordering route registration or adding explicit authentication checks.
Kubeflow Pipelines API server versions through 2.17.3 decompress uploaded pipeline archives without sufficient limits on expanded data size. This allows a crafted compressed archive (ZIP or gzip tar) to consume excessive memory during decompression, potentially exhausting server resources and causing service interruption. The vulnerability can be triggered by unauthenticated callers who can reach the upload endpoints, as decompression occurs before authorization. The issue is fixed in version 2.18.0, which introduces bounds on compressed input and extracted data sizes.