{"id":"CVE-2026-48752","summary":"Incus has arbitrary file read+write on host via templates/ symlink in malicious image","details":"Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue.","aliases":["GHSA-vxp5-584q-c479","GO-2026-5803"],"modified":"2026-11-07T02:32:47.415306108Z","published":"2026-08-21T14:31:57.555Z","related":["GHSA-jpf8-86f3-wp38","GHSA-vxp5-584q-c479","openSUSE-SU-2026:11651-1","openSUSE-SU-2026:21483-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-73"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48752.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48752.json"},{"type":"ADVISORY","url":"https://github.com/canonical/lxd/security/advisories/GHSA-jpf8-86f3-wp38"},{"type":"ADVISORY","url":"https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48752"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/canonical/lxd","events":[{"introduced":"03aab09f5b5cbdada00c6539877dcf5932fcde98"},{"fixed":"2d17567f9f3d17283ab0352305dc8ef62e79cfa8"},{"introduced":"1e1349e3cbf30c1b2ce74e531d4dd0fd52c45be1"},{"fixed":"7b1f0b6acefa288398ead8dda48b046d7b2795a3"},{"introduced":"0"},{"fixed":"c5184be310b13a8be5d9a5f286bfa1c0c286716e"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"4.0.0"},{"fixed":"4.0.11"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"introduced":"5.0.0"},{"fixed":"5.0.7"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"5.1.0"},{"fixed":"5.21.5"}]}]}},{"type":"GIT","repo":"https://github.com/lxc/incus","events":[{"introduced":"0"},{"fixed":"c67888b630ed674dd7b0a77f108521ff1b4c494d"},{"introduced":"714bcc5e42b189f54025b8567df1f3408a1cae2c"},{"fixed":"9a19882fddfd23a0cf34b7f458a49d0687b7c29f"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"7.2.0"}],"source":"AFFECTED_FIELD"},{"strategy":"StringRangeExpression","range":[{"introduced":"6.0.0"},{"fixed":"6.9.0"}],"source":"AFFECTED_FIELD"}]}}],"versions":["lxd-4.0.9","lxd-5.17","lxd-5.16","lxd-5.15","lxd-5.14","lxd-5.13","lxd-5.12","lxd-5.11","lxd-5.0.2","lxd-5.10","lxd-5.9","lxd-5.8","lxd-5.7","lxd-5.6","lxd-5.5","lxd-5.0.1","lxd-5.4","lxd-5.3","lxd-5.2","lxd-5.1","lxd-5.0.0","lxd-4.0.8","lxd-4.0.7","lxd-4.0.6","lxd-4.0.5","lxd-4.0.4","lxd-4.0.3","lxd-4.0.2","lxd-4.0.1","lxd-4.0.0","v6.8.0","v6.7.0","v6.6.0","v6.5.0","v6.4.0","v6.3.0","v6.2.0","v6.0.0","v6.1.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-48752.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}