CVE Catalog
CVE-2026-48749
CriticalCVSS 9.9Summary
Incus prior to version 7.2.0 allows a specially crafted image to read or create/write arbitrary files on the host, possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue.
Risk Assessment
An attacker may gain access to or modify host files, potentially leading to privilege escalation and system takeover.
Recommendation
Upgrade Incus to version 7.2.0 or later.
Original NVD description (English source)
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue.