Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-48749: Incus allows malicious images to access host files
GHSA-2q3f-q5pq-g8wv
CVE-2026-48749
GO-2026-5798
Summary
A malicious image can read and write any file on the host, potentially allowing an attacker to execute any command. This is a serious security risk, and users should be cautious when importing images into Incus. To mitigate this issue, users should ensure they only import images from trusted sources.
What to do
- Update github.com lxc to version 7.2.0.
- Update lxc github.com/lxc/incus/v7 to version 7.2.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | lxc |
< 7.2.0 Fix: upgrade to 7.2.0
|
| Go | lxc | github.com/lxc/incus | All versions |
| Go | lxc | github.com/lxc/incus/v6 | All versions |
| Go | lxc | github.com/lxc/incus/v7 |
< 7.2.0 Fix: upgrade to 7.2.0
|
Original title
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus
Original description
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus
ghsa CVSS3.1
9.9
Vulnerability type
CWE-73
Published: 7 Jul 2026 · Updated: 7 Jul 2026 · First seen: 26 Jun 2026