CVE-2026-104068

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craf...

CVE-2026-104068 JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craf...

CVE-2026-104068

The JetBackup plugin for WordPress (versions before 3.1.24.10 ) is vulnerable to a symlink-based arbitrary file write flaw during the backup import and restore process. The root cause is the failure to validate symbolic links or enforce destination containment when extracting backup archives, all...

EUVD-2026-108228

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craf...

CVE-2026-30345

CVE-2026-30345 Proof of Concept Arbitrary file write vulnerability in CTFd 3.8.2 backup import functionality. Quick Start Before running cve202630345bashrcpoc.py Make sure to update the values accordingly for your exploit. Values such as RHOST, ATTACKER IP or PORT, and the credentials used for th...

CVE-2026-81496

GHSA-26gp-p5fw-3r2h: Arbitrary file write on host via path traversal in instance backup import...

CVE-2026-48756

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

CVE-2026-48754

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An...

EUVD-2026-63981

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An...

CVE-2026-48754

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An...

CVE-2026-48754 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An...

CVE-2026-48754 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An...

CVE-2026-48754 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An...

CVE-2026-48754

Incus (system container and VM manager) prior to 7.1.0 contains a nil-pointer dereference (CWE-476) in (*backend).createDependentVolumesFromBackup in internal/server/storage/backend.go. The function dereferences VolumeSnapshots[i], Volume, and Pool sub-fields of dependent-volume entries without n...

CVE-2026-47753 Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateInstanceFromBackup in internal/server/storage/backend.go contains a nil-pointer dereference that an authenticated user with permission to create instances in any project can trigger remotely by uploadin...

CVE-2026-47753

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateInstanceFromBackup in internal/server/storage/backend.go contains a nil-pointer dereference that an authenticated user with permission to create instances in any project can trigger remotely by uploadin...

CVE-2026-47753 Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateInstanceFromBackup in internal/server/storage/backend.go contains a nil-pointer dereference that an authenticated user with permission to create instances in any project can trigger remotely by uploadin...

CVE-2026-47753

Incus (system container and VM manager) prior to 7.1.0 contains a nil-pointer dereference in (*backend).CreateInstanceFromBackup (internal/server/storage/backend.go). An authenticated user with can_create_instances on any project can trigger a daemon crash by uploading a crafted backup tarball wh...

CVE-2026-48756 Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

SUSE CVE-2026-66898

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploi...