Threats Tagged 'ghsa-f6m5-xw2g-xc4x'

An arbitrary file write vulnerability exists in the Incus client prior to version 7.2.0. This occurs when a malicious image server returns a crafted Incus-Image-Hash header containing path traversal sequences, allowing files to be written outside the intended directory. The vulnerability can lead to arbitrary command execution as root on the server due to the ability to write files such as cron jobs. The file is created and populated before the SHA-256 hash validation occurs, extending the window for exploitation. A proof-of-concept demonstrates how an attacker can exploit this by serving a malicious image with a crafted header and payload.