The flaw resides in glances/secure.py’s secure_popen() function, which interprets file redirection ( > ), piping ( | ), and command chaining ( && ) operators in arbitrary command strings without validating the target file path or the commands themselves. When Application Monitoring Process (AMP) modules load their command or service_cmd values from the configuration file, these values are passed directly to secure_popen() unchecked. This allows an attacker who can modify the Glances configuration to write arbitrary content to any filesystem path, chain arbitrary commands, or pipe command output to arbitrary programs. The immediate consequence is that a compromised configuration file yields unchecked file writes, a classic example of a path traversal, and full command execution with the privileges of the Glances process. Given the lack of integrity checks on glances.conf, the vulnerability is effective only when the attacker can edit configuration files, which may be possible for local users or processes with elevated privileges.

The affected product is Glances, version 4.0.8 through 4.5.5 inclusive, produced by nicolargo. No other products or vendors are listed as affected. The vulnerability is fixed in Glances 4.5.5.

With a CVSS score of 7.8, the vulnerability is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the adversary to write to glances.conf—either through local user privileges, a compromised process, or a vulnerability that gives filesystem write access. Once the configuration is altered, arbitrary filesystem writes and command executions can occur with the same privileges that Glances runs under, potentially enabling full system compromise. The absence of external exposure (no network-facing trigger) limits the attack vector to local or compromised contexts, but the impact remains severe once the configuration is corrupted.