Vulnerability · Published Jun 25, 2026 · Assigned by GitHub_M
CVE-2026-53925Glances: Arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
High 7.8
In plain English
A high-severity path traversal in glances from nicolargo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, the secure_popen() function in glances/secure.py interprets > (file redirection), | (pipe), and && (command chaining) operators in command strings. These operators are applied without any validation on the target file path, piped command, or chained command. When Application Monitoring Process (AMP) modules load their command or service_cmd configuration values from glances.conf, those values are passed directly to secure_popen() with no sanitization. This allows an attacker who can modify the Glances configuration file to write arbitrary content to arbitrary filesystem paths (via >), chain arbitrary commands (via &&), or pipe command output to arbitrary programs (via |). This vulnerability is fixed in 4.5.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | glances | no fix listed | DEBIAN-CVE-2026-53925 |
| Debian:13 | glances | no fix listed | DEBIAN-CVE-2026-53925 |
| Debian:14 | glances | 4.5.5+dfsg-1 | DEBIAN-CVE-2026-53925 |
| PyPI | glances | 4.5.5 | GHSA-3vwc-qwhc-3mj7 |
| PyPI | glances | 4.5.5 | PYSEC-2026-2494 |
| Ubuntu:22.04:LTS | glances | no fix listed | UBUNTU-CVE-2026-53925 |
| Ubuntu:24.04:LTS | glances | no fix listed | UBUNTU-CVE-2026-53925 |
| Ubuntu:25.10 | glances | no fix listed | UBUNTU-CVE-2026-53925 |
| Ubuntu:26.04:LTS | glances | no fix listed | UBUNTU-CVE-2026-53925 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/nicolargo/glances/security/advisories/GHSA-3vwc-qwhc-3mj7 x_refsource_CONFIRM