Security
فارسی
All products

github.com/lxc/incus/v7

Go · Package
17 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Incus has an arbitrary file write on its client due to trusted image hashCVE-2026-48769 · GHSA-F6M5-XW2G-XC4X github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Critical Fix reported
Incus has an argument injection in backup compression algorithm leading to AFW and ACECVE-2026-48755 · GHSA-V6MJ-8PF4-HHW4 github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Critical Fix reported
Incus has arbitrary file read+write on host via templates/ symlink in malicious imageCVE-2026-48752 · GHSA-VXP5-584Q-C479 github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Critical Fix reported
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious imageCVE-2026-48749 · GHSA-2Q3F-Q5PQ-G8WV github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Critical Fix reported
Incus has a restricted project bypass leading to arbitrary command executionCVE-2026-48751 · GHSA-48Q5-W887-33WV github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Critical Fix reported
Incus has an arbitrary file write on host via `exec-output` symlink in crafted imageCVE-2026-48750 · GHSA-73HR-M85F-64V9 github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Critical Fix reported
Incus has a project restriction bypass in instance copy across projectsCVE-2026-55622 · GHSA-C9F5-J9C3-MHRGVersion ranges need review. github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go High Fix reported
Incus has a project restriction bypass for custom volume copy across projectsCVE-2026-55621 · GHSA-64F3-V33M-W89FVersion ranges need review. github.com/lxc/incus/v6github.com/lxc/incus/v7 Go High Fix reported
Incus has an arbitrary file write via path traversal in S3 multipart uploadCVE-2026-48753 · GHSA-CCJC-4QC3-JXQC github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Critical Fix reported
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}CVE-2026-48754 · GHSA-4XG6-52MH-FPW8 github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Low Fix reported
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)CVE-2026-48756 · GHSA-XHQX-MGH3-3H7Q github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Low Fix reported
Incus has a Nil-Pointer Dereference via Custom Volume ImportCVE-2026-40197 · GHSA-R7W7-MMXR-47R9 github.com/lxc/incus/v6/cmd/incusdgithub.com/lxc/incus/v6 Go High Fix reported
Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)CVE-2026-47753 · GHSA-8G7M-96C8-8WWCVersion ranges need review. github.com/lxc/incus/v6github.com/lxc/incus/v7 Go Medium Fix reported
Incus has an OVN TLS Verification that Accepts Peer-Supplied RootsCVE-2026-40243 · GHSA-C839-4QXR-J4X3 github.com/lxc/incus/v6/cmd/incusdgithub.com/lxc/incus/v6 Go Low Fix reported
Incus has Blind SSRF via Image Import Preflight HEADCVE-2026-35527 · GHSA-8GW4-P4WQ-4HCV github.com/lxc/incus/v6/cmd/incusdgithub.com/lxc/incus/v6 Go Medium Fix reported
Incus has a Nil-Pointer Dereference Panic via Bucket MetadataCVE-2026-40195 · GHSA-GC7J-G665-RXR9 github.com/lxc/incus/v6/cmd/incusdgithub.com/lxc/incus/v6 Go High Fix reported
Incus Vulnerable to Panic via Snapshot Bounds CheckCVE-2026-40251 · GHSA-4M88-WXJ4-9QJ6 github.com/lxc/incus/v6/cmd/incusdgithub.com/lxc/incus/v6 Go High Fix reported