CVE-2026-48752

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue.

Score

CVSS 3.1 9.9 Critical

Status

Deferred - security-advisories@github.com

Published

2026-08-21

Last modified

2026-10-15

Weaknesses

CWE-73

Affected products

• Incus (Lxc)

References

• https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479