Incus Container Manager Path Traversal Vulnerability

Executive Summary

CVE-2026-48752 is a critical vulnerability in Incus versions before 7.2.0. It allows attackers to read or write arbitrary files on the host system by exploiting improper handling of symlinks in the templates directory during image extraction or backup restoration. An attacker can craft a malicious container image or backup with a top-level templates symlink pointing to sensitive host directories like /etc/cron.d.

Useful 0 Not Useful 0

Detection Guidance

Check Incus version with 'incus version' to confirm if it is below 7.2.0. Inspect container images and backups for unexpected 'templates' symlinks pointing to sensitive directories like /etc or /var.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to full system compromise. Attackers could read sensitive files, modify system configurations, or execute arbitrary commands on the host. The low attack complexity and lack of required privileges make it easy to exploit, potentially allowing unauthorized access to critical data or system control.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could severely impact compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive data. It may lead to data breaches, loss of confidentiality, and failure to meet security requirements for protecting personal or health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Incus to version 7.2.0 or later immediately. Avoid importing untrusted container images or backups until patched. Monitor for suspicious file changes on the host system.

Useful 0 Not Useful 0