CVE-2026-48749
Critical · CVSS 9.9- CVSS
- 9.9
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-73
Description
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue.
Affected packages
| Go | github.com/lxc/incus | 0 → ∞ |
| Go | github.com/lxc/incus/v6 | 0 → ∞ |
| Go | github.com/lxc/incus/v7 | 0 → 7.2.0 |
| Go | github.com/lxc/incus/v7/cmd/incusd | 0 → 7.2.0 |
References
Status: profiled · ingested 2026-09-19T00:00:27.000Z