Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/lxc/incus/v7/cmd/incusd

10 known vulnerabilities (7 critical, 1 high, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
10 · 7 critical, 1 high, 2 low
Registry
pkg.go.dev

Advisories 10

  • Incus has a project restriction bypass in instance copy across projects

    Affected: fixed in 7.2.0.

  • CVE-2026-48769Critical 9.9

    Incus has an arbitrary file write on its client due to trusted image hash

    Affected: fixed in 7.2.0.

  • CVE-2026-48755Critical 9.9

    Incus has an argument injection in backup compression algorithm leading to AFW and ACE

    Affected: fixed in 7.2.0.

  • Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}

    Affected: fixed in 7.1.0.

  • CVE-2026-48753Critical 9.9

    Incus has an arbitrary file write via path traversal in S3 multipart upload

    Affected: fixed in 7.1.0.

  • CVE-2026-48752Critical 9.9

    Incus has arbitrary file read+write on host via templates/ symlink in malicious image

    Affected: fixed in 7.2.0.

  • CVE-2026-48751Critical 9.9

    Incus has a restricted project bypass leading to arbitrary command execution

    Affected: fixed in 7.2.0.

  • CVE-2026-48750Critical 9.9

    Incus has an arbitrary file write on host via `exec-output` symlink in crafted image

    Affected: fixed in 7.2.0.

  • CVE-2026-48749Critical 9.9

    Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image

    Affected: fixed in 7.2.0.

  • Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)

    Affected: fixed in 7.1.0.