Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Details - cmd/incusd/images.go:611-684 handles source.type=url by HEADing the user-supplied URL, reading Incus-Image-Hash and Incus-Image-URL, and passing them to imageDownload() as Alias and Server. - cmd/incusd/daemonimages.go:91-92 defaults fp to the caller-controlled alias string. - cmd/incusd/daemonimages.go:333-335 builds destName := filepath.Join(destDir, fp). - cmd/incusd/daemonimages.go:469-523 enters the direct protocol branch, opens destName with os.Create(), and copies the HTTP response into that file. - cmd/incusd/daemonimages.go:528-532 validates the SHA-256 only after the file has already been created and populated. - cmd/incusd/daemonimages.go:337-344 cleanup only runs after the copy returns; a slow or held response extends the arbitrary-write window. A malicious image…
Recommended action: Upgrade to 7.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
(backend).CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with cancreatestoragevolumes permission on any project can crash the incusd daemon by uploading a backup tarball whose volumesnapshots[].expiresat field is absent. This is a sibling-field variant of GHSA-r7w7-mmxr-47r9 (CVE-2026-40197). Commit 985a1dedf9f3e7ba729c93b654905ed510de25c2 added if s == nil at the top of the loop body, but did not guard the adjacent snapshot.ExpiresAt deref 19 lines later. Every other consumer of Config.VolumeSnapshots[i].ExpiresAt in this same file already gates the deref with a nil-check — the asymmetric guard is the bug. Vulnerable code internal/server/storage/backend.go, CreateCustomVolumeFromBackup: ExpiresAt is declared time.Time (shared/api/storagepoolvolumesnapshot.go:21,88). Every other consumer in the same…
Recommended action: Upgrade to 7.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Details Incus validates compressionalgorithm by parsing it into fields and checking only the first token against an allowlist: Extra arguments are not rejected. compressFile() then prepends -c and passes the remaining user-supplied fields to the compressor: With a value like: the daemon executes the equivalent of: PoC The following was generated by an LLM model. Impact Improperly validated compression algorithm argument leads to argument injection leading to arbitrary file write with zstd and possibly arbitrary command execution.
Recommended action: Upgrade to 7.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
(backend).createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshots[i], Volume, and Pool sub-fields. An authenticated user with cancreateinstances permission on any project can crash the incusd daemon by uploading an instance backup tarball whose dependentvolumes[] block contains a nil snapshot pointer (or omits volume: / pool:). This is a sibling-field variant of the 2026-05-04 batch fix d768f81c0a1d985f35ae56219519822b080bf5e3 ("Properly check dependent volumes on import"). That commit added if disk == nil at the top of the outer loop, but did not guard the four sub-pointer fields the loop body dereferences naked. Vulnerable code internal/server/storage/backend.go:9352-9412: disk has type config.Config (declared in internal/server/backup/config/backupconfig.go:8). Its Volume field is api.StorageVolume, Pool is api.StoragePool, VolumeSnapshots is…
Recommended action: Upgrade to 7.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. In internal/server/storage/s3/local/multipart.go, user-controlled upload ID is appended to the uploads directory unsanitized; https://github.com/lxc/incus/blob/40dd4f151d52c06b178482aa2518abfb9df3e6fb/internal/server/storage/s3/local/multipart.go#L33 PoC Setup Exploitation The below script was mostly generated. Impact Arbitrary file write on the host. Possibly leading to arbitrary command execution.
Recommended action: Upgrade to 7.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details For container images, internal/server/storage/utils.go calls archive.Unpack(imageFile, destPath, ...). The tar extraction path in shared/archive/archive.go excludes device nodes, but it does not reject a top-level templates symlink. For instance backups, internal/server/storage/drivers/driverdirvolumes.go:rsync.LocalCopy uses argument -a (archive mode), but does not add --safe-links. This allows a top-level templates symlink. In practice, this allows a malicious actor to access an arbitrary directory and edit arbitrary files in it. PoC Malicious container image Below, the templates directory is mapped to /etc/cron.d on the host, but it can be mapped anywhere. After that, create a cronjob to run id as root. Malicious instance backup Below, the templates directory is mapped to /etc/cron.d on the host, but it can…
Recommended action: Upgrade to 7.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qemu. Details Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qemu. As snapshots can be moved from one server to another, a malicious instance+snapshot can be crafted locally, moved to a restricted project and the snapshot restored for arbitrary command execution. In practice, this allows a malicious actor to execute arbitrary commands on the host with root privileges. PoC Impact - Bypass of project restrictions. - Arbitrary command execution on the Incus server.
Recommended action: Upgrade to 7.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named execUUID.stdout and execUUID.stderr can be written to an arbitrary location where the .stdout file will contain arbitrary content. This behavior can be abused for arbitrary command execution. Details When an image is unpacked, top-level symlinks are extracted as is; allowing for exec-output to be placed on disk. In instanceexec.go, os.Mkdir continues of exec-output exists and os.OpenFile follows the exec-output symlink. PoC Below, we place the execUUID.stdout file in /etc/cron.d on the host for arbitrary command execution. Impact Constrained file creation in an arbitrary directory on the host via via an unsanitized symlink; possibly leading to command execution.
Recommended action: Upgrade to 7.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details Incus validates an image as soon as it sees a normal metadata.yaml and a rootfs/ entry, but full extraction can later process a duplicate top-level rootfs symlink. Later, the stopped-container file API opens d.RootfsPath() and passes that file descriptor to forkfile, which chroots to it. In practice, this allows a malicious actor to access the host's filesystem with root privileges. PoC Below, we map the container's rootfs to / on the host, but it can be mapped anywhere. We then retrieve the host's /etc/shadow file and create a file in /. Impact Arbitrary file read and write on the host via unsanitized symlink; possibly leading to command execution.
Recommended action: Upgrade to 7.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.