Incus has arbitrary file read+write on host via templates/ symlink in malicious image

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-48752 · CVE overview and exploitation status

EUVD-2026-63979

GHSA-vxp5-584q-c479

GO-2026-5803

cve-program · CVE-2026-48752

• https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479
• https://github.com/canonical/lxd/security/advisories/GHSA-jpf8-86f3-wp38

euvd · EUVD-2026-63979

• https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479
• https://github.com/canonical/lxd/security/advisories/GHSA-jpf8-86f3-wp38

nvd · CVE-2026-48752

• https://github.com/canonical/lxd/security/advisories/GHSA-jpf8-86f3-wp38
• https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479

osv · GHSA-vxp5-584q-c479

• https://github.com/canonical/lxd/security/advisories/GHSA-jpf8-86f3-wp38
• https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479
• https://nvd.nist.gov/vuln/detail/CVE-2026-48752
• https://github.com/lxc/incus

osv · GO-2026-5803

• https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479

• Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. … · Advisory content revised · 7 Nov 2026
• Incus has arbitrary file read+write on host via templates/ symlink in malicious image · Affected-version evidence changed · 6 Nov 2026
• Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. … · Advisory content revised · 6 Nov 2026
• Incus has arbitrary file read+write on host via templates/ symlink in malicious image · Advisory content revised · 5 Nov 2026