Arbitrary Command Execution in Incus by LXD Prior to Version 7.2.0

CVE-2026-48750

What is CVE-2026-48750?

Prior to version 7.2.0, Incus, a system container and virtual machine manager, contains a vulnerability related to the handling of the record-output parameter in the /instances/$name/exec endpoint. When the exec-output directory is a symlink, the output files exec_UUID.stdout and exec_UUID.stderr are written to a location specified by the attacker. This allows for the possibility of executing arbitrary commands, potentially compromising the security of the system. Version 7.2.0 includes a patch addressing this vulnerability.

References