CVE-2026-48749: critical vulnerability in lxc incus
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.9epss 0.8%
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Related CVEs — lxc incus
In the same product, most dangerous first.
CVE-2026-48769CRITICALIncus has an arbitrary file write on its client due to trusted image hashEPSS 0.8%CVE-2026-48755CRITICALIncus has an argument injection in backup compression algorithm leading to AFW and ACEEPSS 0.8%CVE-2026-48752CRITICALIncus has arbitrary file read+write on host via templates/ symlink in malicious imageEPSS 0.8%CVE-2026-48750CRITICALIncus has an arbitrary file write on host via `exec-output` symlink in crafted imageEPSS 0.8%CVE-2026-23954HIGHIncus container image templating arbitrary host file read and writeEPSS 0.8%CVE-2026-48753CRITICALIncus has an arbitrary file write via path traversal in S3 multipart uploadEPSS 0.7%