Security
فارسی
All products

github.com/lxc/incus/v7/cmd/incusd

Go · Package
10 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Incus has an arbitrary file write on its client due to trusted image hashCVE-2026-48769 · GHSA-F6M5-XW2G-XC4X github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Critical Fix reported
Incus has an argument injection in backup compression algorithm leading to AFW and ACECVE-2026-48755 · GHSA-V6MJ-8PF4-HHW4 github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Critical Fix reported
Incus has arbitrary file read+write on host via templates/ symlink in malicious imageCVE-2026-48752 · GHSA-VXP5-584Q-C479 github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Critical Fix reported
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious imageCVE-2026-48749 · GHSA-2Q3F-Q5PQ-G8WV github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Critical Fix reported
Incus has a restricted project bypass leading to arbitrary command executionCVE-2026-48751 · GHSA-48Q5-W887-33WV github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Critical Fix reported
Incus has an arbitrary file write on host via `exec-output` symlink in crafted imageCVE-2026-48750 · GHSA-73HR-M85F-64V9 github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Critical Fix reported
Incus has a project restriction bypass in instance copy across projectsCVE-2026-55622 · GHSA-C9F5-J9C3-MHRGVersion ranges need review. github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go High Fix reported
Incus has an arbitrary file write via path traversal in S3 multipart uploadCVE-2026-48753 · GHSA-CCJC-4QC3-JXQC github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Critical Fix reported
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}CVE-2026-48754 · GHSA-4XG6-52MH-FPW8 github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Low Fix reported
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)CVE-2026-48756 · GHSA-XHQX-MGH3-3H7Q github.com/lxc/incus/v6github.com/lxc/incus/v7/cmd/incusd Go Low Fix reported