Cyber ·
CVE-2026-108472: input validation flaw in xfs_admin (xfsprogs) allows OS command injection
Advisory shared on the oss-sec list on November 11, 2026: the xfs_admin utility in the xfsprogs package does not validate user input, allowing operating system command injection and, in certain circumstances, local privilege escalation.
According to the advisory shared on the oss-sec list on November 11, 2026, the Red Hat Product Security team reported an input validation flaw in the xfs_admin utility, which is part of the xfsprogs package. The flaw allows operating system command injection and, in certain circumstances, results in local privilege escalation. It was assigned CVE-2026-108472, with Important severity and a CVSSv3.1 score of 7.8. The text received is an automatic translation of the original content. To confirm affected versions, fixed versions and mitigation guidance, consult the original post on the oss-sec list and the vulnerability database or the vendor notice for your Linux distribution. Rota Nacional does not patch operating systems or change the xfsprogs package; this entry is informational only.
Original source: CVE-2026-108472: xfs_admin permite injeção de comandos do sistema operacional