{"id":"CVE-2026-108472","aliases":["DEBIAN-CVE-2026-108472","EUVD-2026-123708","GHSA-7g9v-wrq3-g54m","UBUNTU-CVE-2026-108472"],"status":"published","title":"Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin","description":"A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00908,"percentile":0.60413,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-11-11T18:38:17Z","modified":"2026-11-12T23:46:13Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"xfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1","6.10.1-1","6.11.0-1","6.12.0-1","6.13.0-1","6.13.0-2","6.14.0-1","6.15.0-1","6.16.0-1","6.17.0-1","6.17.0-2","6.18.0-1","6.18.0-2","6.18.0-3","6.18.0-4","6.18.0-5","6.19.0-1","6.3.0-1","6.4.0-1","6.5.0-1","6.6.0-1","6.7.0-1","6.7.0-2","6.7.0-3","6.8.0-1","6.8.0-2","6.8.0-2.1","6.8.0-2.2","7.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"xfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.13.0-2","6.13.0-2+deb13u1","6.14.0-1","6.15.0-1","6.16.0-1","6.17.0-1","6.17.0-2","6.18.0-1","6.18.0-2","6.18.0-3","6.18.0-4","6.18.0-5","6.19.0-1","7.2.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"xfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.13.0-2","6.14.0-1","6.15.0-1","6.16.0-1","6.17.0-1","6.17.0-2","6.18.0-1","6.18.0-2","6.18.0-3","6.18.0-4","6.18.0-5","6.19.0-1","7.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.9ubuntu1","3.1.9ubuntu2","3.1.9ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.1ubuntu1","4.2.0","4.3.0","4.3.0+nmu1","4.3.0+nmu1ubuntu1","4.3.0+nmu1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.0+nmu1ubuntu1","4.9.0+nmu1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1ubuntu1","5.2.1-1ubuntu1","5.3.0-1ubuntu1","5.3.0-1ubuntu2","5.3.0-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-4ubuntu2","5.13.0-1ubuntu1","5.13.0-1ubuntu2","5.13.0-1ubuntu2.1","5.13.0-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.0-1ubuntu1","6.5.0-1","6.5.0-1ubuntu1","6.5.0-1ubuntu2","6.6.0-1ubuntu1","6.6.0-1ubuntu2","6.6.0-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.18.0-3","6.19.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xfsprogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.13.0-2ubuntu2","6.16.0-1","6.17.0-2","6.18.0-3"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.2 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.8 extended update support"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:99659","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:99660","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:99661","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:99662","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:99817","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-108472","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548925","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/11/27","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108472"},{"url":"https://github.com/advisories/GHSA-7g9v-wrq3-g54m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-108472","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-108472","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-108472","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/11/11/27","tags":["report"]},{"url":"https://lore.kernel.org/linux-xfs/20261111151107.3884786-2-aalbersh@kernel.org/T/#u","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-108472","title":"Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin","description":"A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.","status":"published","published":"2026-11-11T18:38:17.37Z","modified":"2026-11-12T22:58:33.371Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-12T23:49:59.845803Z"}],"euvd":[{"id":"EUVD-2026-123708","description":"A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.","status":"published","published":"2026-11-11T18:38:17Z","modified":"2026-11-12T22:58:33Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-13T00:36:24.879993Z"}],"ghsa":[{"id":"GHSA-7g9v-wrq3-g54m","title":"A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user...","description":"A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.","status":"published","published":"2026-11-11T21:32:55Z","modified":"2026-11-13T00:31:51Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-13T00:44:37.510355Z"}],"nvd":[{"id":"CVE-2026-108472","description":"A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.","status":"published","published":"2026-11-11T19:17:29.07Z","modified":"2026-11-12T20:18:15.343Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-12T19:32:19.423888Z"}],"osv":[{"id":"DEBIAN-CVE-2026-108472","description":"A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.","status":"published","published":"2026-11-11T19:17:29.07Z","modified":"2026-11-12T07:47:31.473394006Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-12T05:32:35.067145Z"},{"id":"UBUNTU-CVE-2026-108472","description":"A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.","status":"published","published":"2026-11-12T00:00:00Z","modified":"2026-11-12T23:46:13.433967659Z","updated_at":"2026-11-13T00:19:55.596471Z"}]}}