github.com/lxc/incus/v7/cmd/incusd
Go10 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/lxc/incus/v7/cmd/incusdpage 1 of 1
- CVE-2026-48749CRITICALCVSS 9.9EG 9.9fixed in 7.2.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixe…
- CVE-2026-48750CRITICALCVSS 9.9EG 9.9fixed in 7.2.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory of the instance. If `exe…
- CVE-2026-48751CRITICALCVSS 9.9EG 9.9fixed in 7.2.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel…
- CVE-2026-48752CRITICALCVSS 9.9EG 9.9fixed in 7.2.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution.…
- CVE-2026-48753CRITICALCVSS 9.9EG 9.9fixed in 7.1.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary comm…
- CVE-2026-48754LOWCVSS 2.1EG 2.1fixed in 7.1.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume…
- CVE-2026-48755CRITICALCVSS 9.9EG 9.9fixed in 7.2.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file…
- CVE-2026-48756LOWCVSS 2.1EG 2.1fixed in 7.1.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of e…
- CVE-2026-48769CRITICALCVSS 9.9EG 9.9fixed in 7.2.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary comma…
- CVE-2026-55622HIGHCVSS 7.7EG 7.7fixed in 7.2.02026-08-21
Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an inst…
Check whether github.com/lxc/incus/v7/cmd/incusd is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/lxc/incus/v7/cmd/incusd CVEs against the assets you own.
Book a Demo →