CVE-2026-48750
Received Received - Intake

Arbitrary File Write via Symlink in Incus

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory of the instance. If `exec-output` is a symlink, file named `exec_UUID.stdout` and `exec_UUID.stderr` can be written to an arbitrary location where the `.stdout` file will contain arbitrary content. This behavior can be abused for arbitrary command execution. Version 7.2.0 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-48750
EUVD
EUVD-2026-63977

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
incus incus 7.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48750 is a vulnerability in Incus versions prior to 7.2.0. It allows arbitrary file writes on the host system by exploiting a symlink in the exec-output parameter of the /instances/$name/exec endpoint. Attackers can write files like exec_UUID.stdout or exec_UUID.stderr to any location, potentially leading to arbitrary command execution.

Detection Guidance

Check for suspicious symlinks in the exec-output directory of any Incus instances running versions prior to 7.2.0. Inspect files like exec_UUID.stdout or exec_UUID.stderr in unexpected locations such as /etc/cron.d or other system directories.

Impact Analysis

This vulnerability can lead to full system compromise. Attackers could write malicious files to sensitive locations like /etc/cron.d, enabling persistent access or further attacks. The impact includes high risks to confidentiality, integrity, and availability of the system.

Compliance Impact

This vulnerability could lead to data breaches, unauthorized access, or system compromise, violating compliance requirements for GDPR, HIPAA, and other regulations. It may result in legal penalties, loss of trust, and failure to meet data protection standards.

Mitigation Strategies

Upgrade all Incus instances to version 7.2.0 or later immediately. If upgrading is not possible, disable the record-output feature in the /instances/$name/exec endpoint configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48750. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart