Go/github.com/lxc/incus/v7/cmd/incusd CVE-2026-48750: critical 9.9, EPSS 0.73%

Incus has an arbitrary file write on host via `exec-output` symlink in crafted image

Action: Upgrade github.com/lxc/incus/v7/cmd/incusd to 7.2.0 or later.

go get github.com/lxc/incus/v7/cmd/incusd@v7.2.0

Affected

Fixed versions

Sources

• osv: GHSA-73hr-m85f-64v9
• https://github.com/lxc/incus/security/advisories/GHSA-73hr-m85f-64v9
• https://github.com/lxc/incus

CVE-2026-48750 · published 2026-06-26T18:32:52Z · modified 2026-07-07T20:41:33.230582429Z · JSON