CVE-2026-53925 Details
Description
Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, the secure_popen() function in glances/secure.py interprets > (file redirection), | (pipe), and && (command chaining) operators in command strings. These operators are applied without any validation on the target file path, piped command, or chained command. When Application Monitoring Process (AMP) modules load their command or service_cmd configuration values from glances.conf, those values are passed directly to secure_popen() with no sanitization. This allows an attacker who can modify the Glances configuration file to write arbitrary content to arbitrary filesystem paths (via >), chain arbitrary commands (via &&), or pipe command output to arbitrary programs (via |). This vulnerability is fixed in 4.5.5.
A vulnerability in Glances versions 4.0.8 prior to 4.5.5 allows for arbitrary file writing and command execution through the secure_popen() function. This issue arises because the function improperly handles command strings by interpreting file redirection, piping, and command chaining operators without validating the associated file paths or commands. When Application Monitoring Process (AMP) modules retrieve command values from the Glances configuration file, these unvalidated commands are executed, enabling an attacker to manipulate files and execute commands on the system.
Users are advised to update Glances to version 4.5.5, where this vulnerability has been fixed. Additionally, consider sanitizing AMP command values before execution and removing or restricting file redirection support in the secure_popen() function.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 25, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nicolargo/glances/security/advisories/GHSA-3vwc-qwhc-3mj7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/nicolargo/glances/security/advisories/GHSA-3vwc-qwhc-3mj7 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Glances | >= 4.0.8, <= 4.5.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | New CVE Received | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |