by Kastro
Paper/Archive/CVE-2026-63343

CVE-2026-63343

lxc incus — Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

EPSS 0.5%CVSS 9.9
critical.is priorityof 100
38
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 41.4.414 × 208.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The `exec-output` and `templates/` paths were patched in a prior release using `Lstat` rejection and `os.OpenRoot` confinement; `metadata.yaml` was not included in either patch and remains exploitable. Version 7.3.0 patches the issue.

Affected

ProductAffectedFixed inSource
incus< 7.3.0–CNA

Scores by source

GitHub_M (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/lxc/incus/security/advisories/GHSA-fmjx-5j3g-997p