CVE-2026-48750

Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory of the instance. If `exec-output` is a symlink, file named `exec_UUID.stdout` and `exec_UUID.stderr` can be written to an arbitrary location where the `.stdout` file will contain arbitrary content. This behavior can be abused for arbitrary command execution. Version 7.2.0 contains a patch.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/lxc/incus/security/advisories/GHSA-73hr-m85f-64v9
https://github.com/lxc/incus/security/advisories/GHSA-73hr-m85f-64v9

Configurations

No configuration.

History

15 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Incus es un gestor de contenedores de sistema y máquinas virtuales. Antes de la versión 7.2.0, el parámetro 'record-output' del punto final '/instances/$name/exec' almacena la salida del comando en el directorio 'exec-output' de la instancia. Si 'exec-output' es un enlace simbólico, los archivos llamados 'exec_UUID.stdout' y 'exec_UUID.stderr' pueden escribirse en una ubicación arbitraria donde el archivo '.stdout' contendrá contenido arbitrario. Este comportamiento puede ser abusado para la ejecución arbitraria de comandos. La versión 7.2.0 contiene un parche.

Information

Published : 2026-08-21 15:16

Updated : 2026-10-15 19:10

NVD link : CVE-2026-48750

Mitre link : CVE-2026-48750

CVE.ORG link : CVE-2026-48750

JSON object : View

Products Affected

No product.

CWE

CWE-73

External Control of File Name or Path

{"id": "CVE-2026-48750", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48750", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T17:24:17.722732Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": "< 7.2.0"}]}]}], "published": "2026-08-21T15:16:40.390", "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-73hr-m85f-64v9", "source": "security-advisories@github.com"}, {"url": "https://github.com/lxc/incus/security/advisories/GHSA-73hr-m85f-64v9", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory of the instance. If `exec-output` is a symlink, file named `exec_UUID.stdout` and `exec_UUID.stderr` can be written to an arbitrary location where the `.stdout` file will contain arbitrary content. This behavior can be abused for arbitrary command execution. Version 7.2.0 contains a patch."}, {"lang": "es", "value": "Incus es un gestor de contenedores de sistema y m\u00e1quinas virtuales. Antes de la versi\u00f3n 7.2.0, el par\u00e1metro 'record-output' del punto final '/instances/$name/exec' almacena la salida del comando en el directorio 'exec-output' de la instancia. Si 'exec-output' es un enlace simb\u00f3lico, los archivos llamados 'exec_UUID.stdout' y 'exec_UUID.stderr' pueden escribirse en una ubicaci\u00f3n arbitraria donde el archivo '.stdout' contendr\u00e1 contenido arbitrario. Este comportamiento puede ser abusado para la ejecuci\u00f3n arbitraria de comandos. La versi\u00f3n 7.2.0 contiene un parche."}], "lastModified": "2026-10-15T19:10:00.173", "sourceIdentifier": "security-advisories@github.com"}