CVE Catalog
CVE-2026-48751
CriticalCVSS 9.9Summary
Incus prior to version 7.2.0 ignores the `restricted.containers.lowlevel=block` setting for instance snapshots, allowing arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.
Risk Assessment
A user with snapshot creation privileges can execute arbitrary commands on the server, potentially leading to full system compromise.
Recommendation
Upgrade Incus to version 7.2.0 or later.
Original NVD description (English source)
Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.