[Git][security-tracker-team/security-tracker][master] Add initial tracking for incus issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b6e622c8 by Salvatore Bonaccorso at 2026-07-31T16:38:48+02:00
Add initial tracking for incus issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,55 @@
+CVE-2026-XXXX [GHSA-6v6x-387m-rj4w: Project restriction bypass on network address sets]
+	- incus 7.0.1-2
+	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-6v6x-387m-rj4w
+	NOTE: https://github.com/lxc/incus/pull/3750
+CVE-2026-XXXX [GHSA-67qw-68v3-36h6: Arbitrary file write on host via path traversal in custom volume import]
+	- incus 7.0.1-2
+	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-67qw-68v3-36h6
+	NOTE: https://github.com/lxc/incus/pull/3750
+CVE-2026-XXXX [GHSA-26gp-p5fw-3r2h: Arbitrary file write on host via path traversal in instance backup import]
+	- incus 7.0.1-2
+	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-26gp-p5fw-3r2h
+	NOTE: https://github.com/lxc/incus/pull/3750
+CVE-2026-XXXX [GHSA-7fj9-65v4-rp7h: Arbitrary file write on host via image-planted symlinks and oci.dns.* newline injection]
+	- incus 7.0.1-2
+	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-7fj9-65v4-rp7h
+	NOTE: https://github.com/lxc/incus/pull/3750
+CVE-2026-XXXX [GHSA-4qxq-p5hm-3q3p: Arbitrary host file read+write via VM template path traversal]
+	- incus 7.0.1-2
+	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-4qxq-p5hm-3q3p
+	NOTE: https://github.com/lxc/incus/pull/3750
+CVE-2026-XXXX [GHSA-p2v3-6wvc-cv3p: Arbitrary file write on host via image fingerprint path traversal]
+	- incus 7.0.1-2
+	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-p2v3-6wvc-cv3p
+	NOTE: https://github.com/lxc/incus/pull/3750
+CVE-2026-63343 [Arbitrary file read+write on host via metadata.yaml symlink in crafted image]
+	- incus 7.0.1-2
+	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-fmjx-5j3g-997p
+	NOTE: https://github.com/lxc/incus/pull/3750
+CVE-2026-63125 [Arbitrary file write on host via backup.yaml symlink in crafted image]
+	- incus 7.0.1-2
+	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-6rqx-22hc-qm36
+	NOTE: https://github.com/lxc/incus/pull/3750
+CVE-2026-XXXX [GHSA-m3j6-p3v3-qmjv: Container configuration newline injection through nvidia.driver.capabilities]
+	- incus 7.0.1-2
+	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-m3j6-p3v3-qmjv
+	NOTE: https://github.com/lxc/incus/pull/3750
+CVE-2026-62941 [Project restriction bypass via cross-project instance copy]
+	- incus 7.0.1-2
+	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-mq9x-prm8-3vpw
+	NOTE: https://github.com/lxc/incus/pull/3750
+CVE-2026-62940 [Project restriction bypass via instance migration config override]
+	- incus 7.0.1-2
+	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-qw5c-v953-38gw
+	NOTE: https://github.com/lxc/incus/pull/3750
+CVE-2026-62867 [Argument injection through storage volume block.create_options]
+	- incus 7.0.1-2
+	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-q7xw-r4w2-2wcm
+	NOTE: https://github.com/lxc/incus/pull/3750
+CVE-2026-62313 [Project isolation restriction bypass by omitting security.idmap.isolated]
+	- incus 7.0.1-2
+	NOTE: https://github.com/lxc/incus/security/advisories/GHSA-53cg-qvg7-m8vg
+	NOTE: https://github.com/lxc/incus/pull/3750
 CVE-2026-55707
 	- neutron 2:28.0.1-2 (bug #1143170)
 	NOTE: https://security.openstack.org/ossa/OSSA-2026-032.html



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b6e622c810d871ba7837a7f4438636c2e38629f0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b6e622c810d871ba7837a7f4438636c2e38629f0
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260731/f663381b/attachment.htm>