QSN-8897-1: lxml vulnerabilities
2026-10-07

Summary:
Several security issues were fixed in lxml.

Details:
Guillem Lefait discovered that lxml incorrectly handled certain URL
attributes. A remote attacker could possibly use this issue to bypass
URL sanitization, leading to a cross-site scripting attack.
(CVE-2026-49825)

Qiu Sihao discovered that lxml incorrectly handled untrusted XML input.
A remote attacker could possibly use this issue to read local files and
expose sensitive information. This issue was only addressed in Ubuntu 24.04
LTS and Ubuntu 26.04 LTS. (CVE-2026-41066)

Affected QuantaStor releases:
  6.9.1.001 jammy: python3-lxml 4.8.0-1ubuntu0.1 (fixed in 4.8.0-1ubuntu0.1)
  6.9.0.464 jammy: python3-lxml 4.8.0-1ubuntu0.1 (fixed in 4.8.0-1ubuntu0.1)
  6.8.6.015 jammy: python3-lxml 4.8.0-1build1 (fixed in 4.8.0-1ubuntu0.1)
  6.8.5.018 jammy: python3-lxml 4.8.0-1build1 (fixed in 4.8.0-1ubuntu0.1)
  6.8.4.038 jammy: python3-lxml 4.8.0-1build1 (fixed in 4.8.0-1ubuntu0.1)
  6.8.3.018 jammy: python3-lxml 4.8.0-1build1 (fixed in 4.8.0-1ubuntu0.1)
  6.8.2.002 jammy: python3-lxml 4.8.0-1build1 (fixed in 4.8.0-1ubuntu0.1)
  6.8.1.007 jammy: python3-lxml 4.8.0-1build1 (fixed in 4.8.0-1ubuntu0.1)
  6.8.0.205 jammy: python3-lxml 4.8.0-1build1 (fixed in 4.8.0-1ubuntu0.1)

CVEs: CVE-2026-41066, CVE-2026-49825

References:
  https://ubuntu.com/security/notices/USN-8897-1