CVE-2026-63125
Received Received - Intake

Arbitrary Code Execution in Incus via Malicious Backup Symlink

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as root on the host. A crafted image ships `backup.yaml` as a symlink to a host file. When the root daemon writes the instance's backup file, it follows the symlink. Version 7.3.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-63125
EUVD
EUVD-2026-63952

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
canonical incus to 7.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-61 The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63125 is a critical vulnerability in Incus, a container and virtual machine manager. An unprivileged user with specific permissions can exploit a crafted image containing a malicious symlink named backup.yaml. When the root daemon processes the backup, it follows the symlink, allowing the attacker to overwrite critical host files or execute arbitrary code as root.

Detection Guidance

Check Incus version with 'incus version' to confirm if it is below 7.3.0. Inspect images for suspicious symlinks named 'backup.yaml' pointing to host files. Review system logs for unauthorized file writes or unexpected backup operations.

Impact Analysis

This vulnerability allows an attacker with limited access to gain full root privileges on the host system. They could modify system files, install malware, or take control of the entire host, potentially affecting all containers and virtual machines managed by Incus.

Compliance Impact

This vulnerability could lead to unauthorized access and control of systems, violating data protection requirements under GDPR and HIPAA. It may result in data breaches, loss of confidentiality, and non-compliance with security controls requiring isolation and access restrictions.

Mitigation Strategies

Upgrade Incus to version 7.3.0 or later immediately. Remove untrusted images and instances. Restrict user permissions to prevent image and instance creation for non-admin users. Monitor for unusual file modifications on the host.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63125. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart