CVE-2026-48750
CriticalCVSS 9.9Summary
Incus prior to version 7.2.0 has a vulnerability in the `record-output` parameter of the `/instances/$name/exec` endpoint, where if `exec-output` is a symlink, files named `exec_UUID.stdout` and `exec_UUID.stderr` can be written to an arbitrary location, with the `.stdout` file containing arbitrary content. This can be abused for arbitrary command execution. Version 7.2.0 contains a patch.
Risk Assessment
An attacker can write files to arbitrary locations on the host, potentially leading to arbitrary command execution and system takeover.
Recommendation
Upgrade Incus to version 7.2.0 or later.
Original NVD description (English source)
Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory of the instance. If `exec-output` is a symlink, file named `exec_UUID.stdout` and `exec_UUID.stderr` can be written to an arbitrary location where the `.stdout` file will contain arbitrary content. This behavior can be abused for arbitrary command execution. Version 7.2.0 contains a patch.