CVE-2026-63125 PUBLISHED

Incus vulnerable to root RCE via image backup.yaml symlink

Assigner: GitHub_M
Reserved: 15.07.2026 Published: 21.08.2026 Updated: 21.08.2026

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with can_create_images and can_create_instances) can execute arbitrary code as root on the host. A crafted image ships backup.yaml as a symlink to a host file. When the root daemon writes the instance's backup file, it follows the symlink. Version 7.3.0 patches the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.9

Product Status

Vendor lxc
Product incus
Versions
  • Version < 7.3.0 is affected

References

Problem Types

  • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE
  • CWE-61: UNIX Symbolic Link (Symlink) Following CWE