CVE-2026-63125: critical vulnerability in lxc incus
Incus vulnerable to root RCE via image backup.yaml symlink
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.9epss 0.7%
Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as root on the host. A crafted image ships `backup.yaml` as a symlink to a host file. When the root daemon writes the instance's backup file, it follows the symlink. Version 7.3.0 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
lxc · incusRelated CVEs — lxc incus
In the same product, most dangerous first.
CVE-2026-48769CRITICALIncus has an arbitrary file write on its client due to trusted image hashEPSS 0.8%CVE-2026-48755CRITICALIncus has an argument injection in backup compression algorithm leading to AFW and ACEEPSS 0.8%CVE-2026-48752CRITICALIncus has arbitrary file read+write on host via templates/ symlink in malicious imageEPSS 0.8%CVE-2026-48750CRITICALIncus has an arbitrary file write on host via `exec-output` symlink in crafted imageEPSS 0.8%CVE-2026-48749CRITICALIncus has an arbitrary file read+write on host via rootfs/ symlink in malicious imageEPSS 0.8%CVE-2026-23954HIGHIncus container image templating arbitrary host file read and writeEPSS 0.8%