CVE-2026-48750

Name of the Vulnerable Software and Affected Versions Incus (affected versions not specified)

Description An arbitrary file write issue exists on the host system when using a crafted image. The /instances/$name/exec endpoint uses the record-output parameter to store command output in the exec-output directory of an instance. If exec-output is a symlink, the system follows it, allowing files named exec UUID.stdout and exec UUID.stderr to be written to an arbitrary location. This occurs because top-level symlinks are extracted as is during image unpacking, and the os.OpenFile function in instance exec.go follows the symlink. This behavior can be abused to achieve arbitrary command execution on the host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.