Copyright © 2012 Red Hat, Inc. All rights reserved. Critical 2026-08-21T14:31:57 incus: Incus has arbitrary file read+write on host via templates/ symlink in malicious image 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE-61

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue.

A flaw was found in Incus, a container and virtual machine manager. A crafted container image or backup can use a symlink in the templates directory to read or write arbitrary files on the host, potentially leading to command execution.

Incus is not shipped in any Red Hat product. The community Fedora package is affected. No mitigation is needed as Incus is not shipped in any Red Hat product. https://www.cve.org/CVERecord?id=CVE-2026-48752 https://nvd.nist.gov/vuln/detail/CVE-2026-48752 https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479