CVE Catalog
CVE-2026-48752
CriticalCVSS 9.9Summary
Incus prior to version 7.2.0 allows a specially crafted image or instance backup to read or create/write arbitrary files on the host, possibly leading to arbitrary command execution. Version 7.2.0 patches the issue.
Risk Assessment
An attacker may gain access to or modify host files, potentially leading to privilege escalation and system takeover.
Recommendation
Upgrade Incus to version 7.2.0 or later.
Original NVD description (English source)
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue.