PT-2026-75902

CVE-2026-63125

Published

2026-07-31

Updated

2026-09-21

Description by

CVSS 3.1

9.9

Critical

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.3.0

Description An unprivileged, project-confined user with can create images and can create instances permissions can execute arbitrary code as root on the host. This occurs when a crafted image includes a backup.yaml file as a symlink to a host file, which the root daemon follows when writing the instance backup file.

Recommendations Update to version 7.3.0.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-59: Improper Link Resolution Before File Access (\'Link Following\')

CWE-61: UNIX Symbolic Link (Symlink) Following

Related identifiers

CVE-2026-63125