Incus Improper File Access Leading to Arbitrary Command Execution

Executive Summary

CVE-2026-48749 is a critical vulnerability in Incus versions prior to 7.2.0. It allows arbitrary file read and write access on the host system through a specially crafted image containing a malicious symlink named 'rootfs/' pointing to the host's root directory. When processed, this symlink can be exploited via the container's file API to access or modify host files with root privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of Incus installed on your system. Run: incus version. If the version is below 7.2.0, the system is vulnerable. Additionally, inspect images for suspicious symlinks named 'rootfs/' pointing to '/'. Use: incus image list to review images and their properties.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to retrieve sensitive files like /etc/shadow or create arbitrary files on the host system. This could lead to arbitrary command execution, compromising the host's confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. Unauthorized file access or modification may result in data breaches, triggering legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Incus to version 7.2.0 or later. Run: sudo apt update && sudo apt upgrade incus. Remove any untrusted or suspicious images. Avoid using images from untrusted sources until verified.

Useful 0 Not Useful 0