Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-48769: Incus client writes files to arbitrary locations
GHSA-f6m5-xw2g-xc4x
CVE-2026-48769
GO-2026-5806
Summary
A malicious image server can write files to any location on the Incus server, potentially allowing an attacker to execute commands as root. This is due to a weakness in how Incus handles image downloads. To mitigate this, ensure that your Incus server is not configured to download images from untrusted sources.
What to do
- Update github.com lxc to version 7.2.0.
- Update lxc github.com/lxc/incus/v7 to version 7.2.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | lxc |
< 7.2.0 Fix: upgrade to 7.2.0
|
| Go | lxc | github.com/lxc/incus | All versions |
| Go | lxc | github.com/lxc/incus/v6 | All versions |
| Go | lxc | github.com/lxc/incus/v7 |
< 7.2.0 Fix: upgrade to 7.2.0
|
Original title
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus
Original description
Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus
ghsa CVSS3.1
9.9
Vulnerability type
CWE-20
Improper Input Validation
Published: 7 Jul 2026 · Updated: 7 Jul 2026 · First seen: 26 Jun 2026