CVE Explorer
CVE-2026-33897
Incus is a system container and virtual machine manager. Prior to version 6.23.0, instance template files can be used to cause arbitrary read or writes as root on the host server. Incus allows for pongo2 templates within instances which can be used at various times in the instance lifecycle to template files inside of the instance. This particular implementation of pongo2 within Incus allowed for file read/write but with the expectation that the pongo2 chroot feature would isolate all such acces
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"incus","vendor":"lxc","versions":[{"status":"affected","version":"< 6.23.0"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:3d08f6316a754b743170e63ed2708ff3d7b6b8702e7eabc36217ca84446f65c2 · sha256:2b3763b16d0a8c13… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:3d08f6316a754b743170e63ed2708ff3d7b6b8702e7eabc36217ca84446f65c2 · sha256:2b3763b16d0a8c13… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-1336","description":"CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:3d08f6316a754b743170e63ed2708ff3d7b6b8702e7eabc36217ca84446f65c2 · sha256:2b3763b16d0a8c13… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"name":"https://github.com/lxc/incus/security/advisories/GHSA-83xr-5xxr-mh92","tags":["x_refsource_CONFIRM"],"url":"https://github.com/lxc/incus/security/advisories/GHSA-83xr-5xxr-mh92"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:3d08f6316a754b743170e63ed2708ff3d7b6b8702e7eabc36217ca84446f65c2 · sha256:2b3763b16d0a8c13… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.