Description
The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If a malicious user has access to a text-based connection, a specially-crafted sequence of console codes could allow arbitrary code to be executed
with the privileges of the running guacd process.
Users are recommended to upgrade to version 1.6.0, which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Guacamole | 0.8.0 – ≤ 1.5.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | guacamole-client | No fix yet | — |
| Ubuntu 16.04 LTS | guacamole-client | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | guacamole-server | 1.6.0-r0 | — |
| Alpine v3.23 | guacamole-server | 1.6.0-r0 | — |
Advisories 3
- WID-SEC-2025-2360 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- NCSC-2025-0330 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Oct 23, 2025
- WID-SEC-2025-1442 Apache Guacamole: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jul 1, 2025
References
- https://lists.apache.org/thread/sgs8lplbkrpvd3hrvcnnxh3028h4py70 vendor-advisory