CVE-2026-48749

Name of the Vulnerable Software and Affected Versions Incus (affected versions not specified)

Description An issue exists where a specially crafted image can be used to read or create and write arbitrary files on the host, potentially leading to arbitrary command execution. The problem occurs because the software validates an image upon detecting a metadata.yaml and a rootfs/ entry, but subsequent extraction can process a duplicate top-level rootfs symlink. This allows a malicious actor to access the host filesystem with root privileges when the stopped-container file API opens d.RootfsPath() and passes the file descriptor to forkfile, which then chroots to it.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.