Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-48749 · CVE overview and exploitation status

EUVD-2026-63976

GHSA-2q3f-q5pq-g8wv

GO-2026-5798

cve-program · CVE-2026-48749

• https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv
• https://github.com/canonical/lxd/security/advisories/GHSA-vghh-5rfx-xhq8

euvd · EUVD-2026-63976

• https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv
• https://github.com/canonical/lxd/security/advisories/GHSA-vghh-5rfx-xhq8

nvd · CVE-2026-48749

• https://github.com/canonical/lxd/security/advisories/GHSA-vghh-5rfx-xhq8
• https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv

osv · GHSA-2q3f-q5pq-g8wv

• https://github.com/canonical/lxd/security/advisories/GHSA-vghh-5rfx-xhq8
• https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv
• https://nvd.nist.gov/vuln/detail/CVE-2026-48749
• https://github.com/lxc/incus

osv · GO-2026-5798

• https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv

• Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes… · Advisory content revised · 7 Nov 2026
• Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image · Affected-version evidence changed · 6 Nov 2026
• Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes… · Advisory content revised · 6 Nov 2026
• Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image · Advisory content revised · 5 Nov 2026