CVE-2026-48752: Incus Container Manager RCE Vulnerability

CVE-2026-48752 Overview

CVE-2026-48752 is a path traversal vulnerability in Incus, an open-source system container and virtual machine manager maintained by the Linux Containers project. A specially crafted image or instance backup can read or create and write arbitrary files on the host system. The flaw is classified as external control of file name or path [CWE-73] and can lead to arbitrary command execution on the underlying host. All versions of Incus prior to 7.2.0 are affected, and the maintainers released version 7.2.0 to patch the issue.

Critical Impact
An authenticated user able to submit an image or backup archive to Incus can escape the intended import directory to read or write host files, enabling privilege escalation and potential arbitrary command execution on the container host.

Affected Products

Incus system container and virtual machine manager, all versions prior to 7.2.0
Incus deployments accepting user-supplied image or instance backup archives
Hosts running vulnerable Incus daemons that process untrusted backup tarballs

Discovery Timeline

2026-08-21 - CVE-2026-48752 published to the National Vulnerability Database
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-48752

Vulnerability Analysis

Incus processes image files and instance backups as tar archives containing metadata and rootfs contents. The extraction logic prior to version 7.2.0 did not fully constrain entry paths within the intended target directory. An attacker who supplies a crafted archive can include entries with traversal sequences or absolute paths that resolve outside the extraction root. This allows the Incus daemon, which typically runs with elevated privileges, to read or write files anywhere on the host filesystem.

Because Incus performs archive handling with high privileges, writing to sensitive locations such as /etc, systemd unit directories, or cron paths yields arbitrary command execution on the host. The scope change indicated by the vulnerability metrics reflects that a compromise crosses the container/host trust boundary.

Root Cause

The root cause is insufficient validation of file paths contained in image and backup archives during import. The extraction routine trusted archive-supplied filenames without canonicalizing and confining them to the destination directory, aligning with [CWE-73] external control of file name or path.

Attack Vector

The attack requires network-reachable access to the Incus API with permissions to import an image or restore an instance backup. An attacker crafts a tar archive that includes entries pointing outside the extraction directory, for example using ../ sequences or absolute paths. When Incus imports the archive, arbitrary files on the host are read into instance state or overwritten with attacker-controlled content, delivering command execution when written to a location that is later executed by the host.

No verified exploit code is publicly indexed for this CVE. See the Incus GitHub Security Advisory GHSA-vxp5-584q-c479 for maintainer details.

Detection Methods for CVE-2026-48752

Indicators of Compromise

Unexpected files appearing in host directories such as /etc, /root, /var/spool/cron, or systemd unit paths shortly after an Incus image or backup import operation.
Incus daemon log entries showing image or backup imports from unusual users, remote endpoints, or with archives containing paths that resolve outside the expected instance directory.
Modifications to Incus configuration files or trust store entries not correlated with administrator activity.

Detection Strategies

Audit Incus API access logs for POST /1.0/images and POST /1.0/instances/<name>/backups calls made by non-administrative identities.
Enable filesystem integrity monitoring on host paths outside /var/lib/incus to identify writes that originate from the Incus daemon process.
Inspect archived images and backup tarballs for entries whose normalized paths escape the archive root before allowing import.

Monitoring Recommendations

Forward Incus daemon logs and host auditd events into a centralized analytics platform for correlation with process ancestry.
Alert on writes performed by the Incus daemon process to paths outside its expected working directories.
Track version inventory of Incus binaries across hosts to confirm patched deployments.

How to Mitigate CVE-2026-48752

Immediate Actions Required

Upgrade all Incus installations to version 7.2.0 or later, which contains the fix for the path traversal in archive handling.
Restrict Incus API access using client certificates and project-scoped permissions so that only trusted users can import images or restore backups.
Review recent image and backup imports and inspect the host filesystem for unexpected modifications outside /var/lib/incus.

Patch Information

The Incus maintainers released version 7.2.0 to remediate CVE-2026-48752. Details are published in the Incus GitHub Security Advisory GHSA-vxp5-584q-c479. Administrators should upgrade the incus and incusd packages on all hosts and restart the daemon to apply the fix.

Workarounds

Disallow image and backup imports from untrusted sources until Incus is upgraded to 7.2.0.
Remove or downgrade permissions for non-administrative users that would otherwise be able to submit archives to the Incus API.
Validate third-party image and backup tarballs on an isolated system before importing them into production Incus hosts.

bash

# Verify installed Incus version and upgrade
incus --version

# Debian/Ubuntu with the Zabbly repository
sudo apt update && sudo apt install --only-upgrade incus incus-client

# Restart the daemon after upgrade
sudo systemctl restart incus

# Confirm the patched version is running
incus info | grep -i server_version