CVE-2026-48749
Description
A flaw was found in Incus, a container and virtual machine manager. A crafted container image can use a symlink in the rootfs directory to read or write arbitrary files on the host, potentially leading to command execution.
Statement
Incus is not shipped in any Red Hat product. The community Fedora package is affected.
Mitigation
No mitigation is needed as Incus is not shipped in any Red Hat product.
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Files or Directories; Modify Files or Directories
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
