External risk intelligence

Incus Arbitrary Command Execution via Exec Output Symlink Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-48750

Incus is a system container and VM manager. While it provides APIs for management, these are typically internal services used by administrators or orchestration systems rather than public-facing internet services. While they can be exposed to a network, they are not intended to be exposed to the public internet by design in normal deployment patterns.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory describes a vulnerability in Incus, a system for managing containers and virtual machines, that could allow for arbitrary command execution. The issue arises from how the system handles command output when a specific configuration is present, potentially leading to unauthorized control. The main concern is confirming relevance and exposure given the nature of the affected technology.

A system management tool has a command execution flaw.
It could allow unauthorized control of systems.
Confirm if our systems use this management tool.

Attack Path

How an attacker could exploit the issue

An attacker with low-privileged access to Incus could exploit this vulnerability by targeting the `record-output` parameter of the `/instances/$name/exec` endpoint. If the `exec-output` directory is a symbolic link, the attacker can manipulate it to write files containing arbitrary content to unintended locations, potentially leading to arbitrary command execution.

Requires authenticated access.
Triggered by manipulating `exec-output` as a symlink.
Risk of arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

When the `record-output` parameter is used with the `/instances/$name/exec` endpoint and the `exec-output` directory is a symlink, arbitrary files can be written to an arbitrary location. This vulnerability could lead to arbitrary command execution when supported by the advisory's conditions.

Instance data and system files at risk.
Command output written to arbitrary locations.
Arbitrary command execution could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The `incus` system container and virtual machine manager's `exec-output` functionality requires attention from platform or infrastructure teams responsible for managing the container environment. The initial step involves identifying all deployments of `incus`, determining their reachability and criticality, and confirming the accountable owner before planning remediation.

Platform or infrastructure teams own resolution.
Verify `incus` deployments and reachability.
Plan and coordinate remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Incus and what is it used for?

Incus is an open-source tool designed to manage system containers and virtual machines. It provides an environment where administrators can create, run, and orchestrate these isolated instances on a single host. It is commonly used in infrastructure management to streamline the deployment and lifecycle of various workloads.

What does CWE-73 mean for CVE-2026-48750?

CWE-73 refers to 'External Control of File Name or Path.' In this vulnerability, the system incorrectly handles file paths when storing command output. Because the software does not properly validate that a directory is not a symbolic link, an attacker can influence where the system writes output files, leading to unauthorized file creation and potentially arbitrary code execution.

How can an attacker trigger this vulnerability?

An attacker triggers this by targeting the 'record-output' parameter within the '/instances/$name/exec' endpoint. This requires the attacker to have existing low-privileged access to the Incus system. The vulnerability is not triggered if the 'exec-output' directory is a standard directory rather than a maliciously crafted symbolic link.

Is my Incus deployment at risk?

According to Halo Surface Signal, Incus is typically an internal management service used by administrators or orchestration systems. While it provides network-accessible APIs, these are not designed to be exposed to the public internet. Systems that are restricted to internal networks or local management use represent a significantly lower risk profile than those improperly exposed.

What should I do to address this vulnerability?

The primary step is to identify all running instances of Incus within your environment and confirm their current version. If you are running a version earlier than 7.2.0, you should coordinate with your infrastructure or platform teams to update to version 7.2.0 or later, which includes the necessary patch to prevent improper path handling.

References

github.com/lxc/incus/security/advisories/GHSA-73hr-m85f-64v9

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.