The vulnerability of the “record-output” parameter at the final destination /instances/$name/exec of the Docker control system and the Incus virtual machine manager allows a attacker to execute arbitrary commands.

The vulnerability of the “record-output” parameter at the final destination /instances/$name/exec of the Docker control system and the Incus virtual machine manager is related to improper external management of file names or file paths. Exploiting this vulnerability allows a remote attacker to...

CVE-2026-48750

Incus is a system container and virtual machine manager. Prior to version 7.2.0, the record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named execUUID.stdout and...

CVE-2026-48750: External Control of File Name or Path

Incus is a system container and virtual machine manager. Prior to version 7.2.0, the record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named execUUID.stdout and...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the record-output process. An attacker can create or overwrite files on the host system by exploiting a crafted symlink in a container image, which can lead to arbitrary command execution...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the record-output process. An attacker can create or overwrite files on the host system by exploiting a crafted symlink in a container image, which can lead to arbitrary command execution...

PT-2026-53011

Name of the Vulnerable Software and Affected Versions Incus affected versions not specified Description An arbitrary file write issue exists on the host system when using a crafted image. The /instances/$name/exec endpoint uses the record-output parameter to store command output in the exec-outpu...