Directory Traversal and Arbitrary File Access in Incus System Container Manager

CVE-2026-23954

What is CVE-2026-23954?

The Incus system container and virtual machine manager is at risk due to a vulnerability that allows users with permissions to launch containers using custom images to exploit directory traversal or symbolic links. The issue arises from insufficient checks on paths when processing templates with metadata.yaml files, enabling potential unauthorized access to host files as well as arbitrary command execution on the host system. A patch has been announced for future releases, but has not yet been implemented in the current versions.

References