{"id":"CVE-2026-48750","summary":"Incus has an arbitrary file write on host via `exec-output` symlink in crafted image","details":"Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory of the instance. If `exec-output` is a symlink, file named `exec_UUID.stdout` and `exec_UUID.stderr` can be written to an arbitrary location where the `.stdout` file will contain arbitrary content. This behavior can be abused for arbitrary command execution. Version 7.2.0 contains a patch.","aliases":["GHSA-73hr-m85f-64v9","GO-2026-5801"],"modified":"2026-11-07T02:32:33.906831435Z","published":"2026-08-21T14:19:45.109Z","related":["GHSA-73hr-m85f-64v9","GHSA-9j25-mm2h-2f76","openSUSE-SU-2026:11651-1","openSUSE-SU-2026:21483-1"],"database_specific":{"cwe_ids":["CWE-73"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48750.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48750.json"},{"type":"ADVISORY","url":"https://github.com/canonical/lxd/security/advisories/GHSA-9j25-mm2h-2f76"},{"type":"ADVISORY","url":"https://github.com/lxc/incus/security/advisories/GHSA-73hr-m85f-64v9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48750"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/canonical/lxd","events":[{"introduced":"03aab09f5b5cbdada00c6539877dcf5932fcde98"},{"fixed":"2d17567f9f3d17283ab0352305dc8ef62e79cfa8"},{"introduced":"1e1349e3cbf30c1b2ce74e531d4dd0fd52c45be1"},{"fixed":"7b1f0b6acefa288398ead8dda48b046d7b2795a3"},{"introduced":"0"},{"fixed":"c5184be310b13a8be5d9a5f286bfa1c0c286716e"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"4.0.0"},{"fixed":"4.0.11"}],"source":"AFFECTED_FIELD"},{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"5.0.0"},{"fixed":"5.0.7"}]},{"strategy":"StringRangeExpression","range":[{"introduced":"5.1.0"},{"fixed":"5.21.5"}],"source":"AFFECTED_FIELD"}]}},{"type":"GIT","repo":"https://github.com/lxc/incus","events":[{"introduced":"0"},{"fixed":"c67888b630ed674dd7b0a77f108521ff1b4c494d"},{"introduced":"714bcc5e42b189f54025b8567df1f3408a1cae2c"},{"fixed":"9a19882fddfd23a0cf34b7f458a49d0687b7c29f"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"7.2.0"}]},{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"6.0.0"},{"fixed":"6.9.0"}]}]}}],"versions":["lxd-4.0.9","lxd-5.17","lxd-5.16","lxd-5.15","lxd-5.14","lxd-5.13","lxd-5.12","lxd-5.11","lxd-5.0.2","lxd-5.10","lxd-5.9","lxd-5.8","lxd-5.7","lxd-5.6","lxd-5.5","lxd-5.0.1","lxd-5.4","lxd-5.3","lxd-5.2","lxd-5.1","lxd-5.0.0","lxd-4.0.8","lxd-4.0.7","lxd-4.0.6","lxd-4.0.5","lxd-4.0.4","lxd-4.0.3","lxd-4.0.2","lxd-4.0.1","lxd-4.0.0","v6.8.0","v6.7.0","v6.6.0","v6.5.0","v6.4.0","v6.3.0","v6.2.0","v6.0.0","v6.1.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-48750.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}