CVE-2026-48752
CRITICAL
INFO
Priority: 0.08
BB Relevance:
70/100
Published: 2026-08-21
Modified: 2026-11-06
First seen: 2026-11-05
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
Changed
C:
High
I:
High
A:
High
Description
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue.
Weakness Classification (1)
Affected Software (10)
| Vendor | Product | Version |
|---|---|---|
| canonical | lxd | >= 4.0.0, < 4.0.11 |
| canonical | lxd | >= 5.0.0, < 5.0.7 |
| canonical | lxd | >= 5.1.0, < 5.21.5 |
| canonical | lxd | >= 6.0.0, < 6.9.0 |
| canonical | lxd | >= 4.0.0, < 4.0.11 |
| canonical | lxd | >= 5.0.0, < 5.0.7 |
| canonical | lxd | >= 5.1.0, < 5.21.5 |
| canonical | lxd | >= 6.0.0, < 6.9.0 |
| lxc | incus | < 7.2.0 |
| lxc | incus | < 7.2.0 |
References & Advisories (2)
x_refsource_MISC
x_refsource_CONFIRM