467 matches found
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation via the imageDownload process. An attacker can overwrite arbitrary files on the host system and potentially execute arbitrary commands as root by supplying a crafted Incus-Image-Hash header containing directory...
GHSA-F6M5-XW2G-XC4X Incus has an arbitrary file write on its client due to trusted image hash
Summary An arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Details - cmd/incusd/images.go:611-684 handles source.type=url by HEADing the user-supplied URL,...
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)
Summary backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with cancreatestoragevolumes permission on any project ca...
Incus has an argument injection in backup compression algorithm leading to AFW and ACE
Summary Improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Details Incus validates compressionalgorithm by parsing it int...
GHSA-4XG6-52MH-FPW8 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
Summary backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An authenticated user with cancreateinstances permission on any project can crash...
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
Summary backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An authenticated user with cancreateinstances permission on any project can crash...
GHSA-CCJC-4QC3-JXQC Incus has an arbitrary file write via path traversal in S3 multipart upload
Summary The S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. In internal/server/storage/s3/local/multipart.go, user-controlled upload ID is appended to the uploads directory...
GHSA-VXP5-584Q-C479 Incus has arbitrary file read+write on host via templates/ symlink in malicious image
Summary A specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details For container images, internal/server/storage/utils.go calls archive.UnpackimageFile, destPath, .... The tar extraction pa...
GHSA-48Q5-W887-33WV Incus has a restricted project bypass leading to arbitrary command execution
Summary Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qemu. Details Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization through the raw.lxc and raw.qemu hooks when the restricted.containers.lowlevel=block setting is ignored during instance snapshot restoration. An attacker can execute arbitrary commands with root privileges on the...
[SECURITY] [DSA 6370-1] incus security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6370-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 26, 2026 https://www.debian.org/security/faq -...
Debian dsa-6370 : xnest - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6370 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6370-1 [email protected] https://www.debian.org/securit...
PT-2026-56688
Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.2.0 Description Missing authorization checks in custom volume copying allow an attacker to copy a custom volume to a new project if they know the name of a project they lack access to and the name of a custom volume...
PT-2026-56689
Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.2.0 Description Missing authorization checks during instance copying allow an attacker who knows the name of a project and an instance within that project to copy the instance to a new project, even without authorized...
PT-2026-53016
Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.2.0 Description An arbitrary file write exists in the Incus client. This occurs when a malicious image server returns a specially crafted Incus-Image-Hash header. The client uses this header to determine the destinati...
PT-2026-53012
Name of the Vulnerable Software and Affected Versions Incus affected versions not specified Description Instance snapshots ignore the restricted.containers.lowlevel=block setting, which allows for arbitrary command execution on the Incus server. This occurs by abusing lowlevel hooks such as raw.l...
GO-2026-5742 Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus
Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus...
GO-2026-5612 Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus
Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus...