UBUNTU-CVE-2026-108472: Command Injection
Published Nov 12, 2026
·Updated
A flaw was found in the xfsadmin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfsadmin is executed.
Affected Software
8 affected components
ubuntu/xfsprogs*
ubuntu/xfsprogs*
ubuntu/xfsprogs*
ubuntu/xfsprogs*
ubuntu/xfsprogs*
ubuntu/xfsprogs*
ubuntu/xfsprogs*
ubuntu/xfsprogs*
Event History
Nov 12, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Who is exposed to this issue?
Systems with xfsprogs installed are potentially exposed when a local user can invoke xfs_admin with attacker-controlled arguments. The impact may include privilege escalation depending on how xfs_admin is executed.
2
What does an attacker need to exploit it?
An attacker needs local access and the ability to supply crafted input arguments to xfs_admin. Successful exploitation can result in arbitrary operating system command execution.