github.com/lxc/incus/v7/cmd/incusd
Go10 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/lxc/incus/v7/cmd/incusdpage 1 of 1
- CVE-2026-48749CRITICALCVSS 9.9EG 9.9✓ Fixed in 7.2.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixe…
- CVE-2026-48750CRITICALCVSS 9.9EG 9.9✓ Fixed in 7.2.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory of the instance. If `exe…
- CVE-2026-48751CRITICALCVSS 9.9EG 9.9✓ Fixed in 7.2.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel…
- CVE-2026-48752CRITICALCVSS 9.9EG 9.9✓ Fixed in 7.2.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution.…
- CVE-2026-48753CRITICALCVSS 9.9EG 9.9✓ Fixed in 7.1.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary comm…
- CVE-2026-48754LOWCVSS 2.1EG 2.1✓ Fixed in 7.1.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume…
- CVE-2026-48755CRITICALCVSS 9.9EG 9.9✓ Fixed in 7.2.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file…
- CVE-2026-48756LOWCVSS 2.1EG 2.1✓ Fixed in 7.1.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of e…
- CVE-2026-48769CRITICALCVSS 9.9EG 9.9✓ Fixed in 7.2.02026-06-26
Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary comma…
- CVE-2026-55622HIGHCVSS 7.7EG 7.7✓ Fixed in 7.2.02026-08-21
Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an inst…
Check whether github.com/lxc/incus/v7/cmd/incusd is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/lxc/incus/v7/cmd/incusd CVEs against the assets you own.
Start Free Scan →