Arbitrary Code Execution Vulnerability in Incus System Container Manager

CVE-2026-63125

What is CVE-2026-63125?

Incus, a system container and virtual machine manager, has a vulnerability that allows unprivileged users with certain permissions to execute arbitrary code with root privileges on the host system. An attacker can craft a malicious image that includes a backup.yaml file, which is used as a symbolic link to a sensitive file on the host. When the instance's backup process is initiated, the root daemon inadvertently follows this symlink, thereby executing the code contained in the crafted image. The issue has been resolved in version 7.3.0, which addresses this security flaw.

References