External risk intelligence

Incus Backup Arbitrary File Write and Read Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-48752

Incus is a system container and virtual machine manager typically deployed on internal infrastructure or dedicated hosts. While it may be network-reachable, its primary purpose is management and orchestration of local or internal workloads. It is not designed to be a public-facing internet service, making common public internet exposure unlikely in standard deployments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Incus, a system for managing containers and virtual machines. If exploited, an attacker could potentially access or modify sensitive files on the host system, leading to the execution of unauthorized commands. This could have significant implications for the integrity and security of the underlying infrastructure. Version 7.2.0 of Incus addresses this issue.

Image or backup files can read/write host files.
Consider the impact on your managed systems.
Confirm relevance and exposure of Incus.

Attack Path

How an attacker could exploit the issue

An attacker with low-privileged access could exploit this vulnerability by providing a specially crafted image or instance backup to Incus. This malicious input could then allow the attacker to read or write arbitrary files on the host system, potentially leading to unauthorized command execution.

Requires low-privileged access.
Triggered by a crafted image or backup.
Allows arbitrary file read/write.

Live Threat

Current exploitation, exposure, and threat context

A specially crafted image or instance backup could allow an attacker with limited access to read or write arbitrary files on the host system, potentially leading to the execution of commands. This could occur when the backup mechanism is triggered with malicious input.

Host system files.
Specially crafted backup files.
Arbitrary file access and command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Incus, a system container and virtual machine manager, requires attention from infrastructure or platform teams responsible for managing virtualization environments. The initial focus should be on identifying all Incus deployments, assessing their exposure and business criticality, and locating the designated system owner. This will allow for a prioritized remediation plan based on the identified risks.

Identify Incus deployments and owners.
Verify network reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Incus and what is it used for?

Incus is an open-source tool that manages system containers and virtual machines. Administrators use it to package, deploy, and isolate applications or full operating systems on a host machine, providing a flexible environment for running multiple workloads securely on the same underlying hardware.

What does CVE-2026-48752 mean in plain English?

This vulnerability is classified as CWE-73, or External Control of File Name or Path. It means the software does not properly validate file paths when processing specific inputs. Consequently, an attacker can trick the system into reading or writing files outside of intended directories, potentially compromising the entire host.

How can an attacker trigger this vulnerability?

An attacker triggers the flaw by providing a malicious, specially crafted instance backup or container image file to the system. Simply having the software installed does not trigger the bug; the system must actively import or process one of these manipulated files to initiate the unauthorized file operations.

Do I need to worry about this if my Incus instance is internal?

According to Halo Surface Signal, Incus is typically used for internal infrastructure or dedicated hosts rather than as a public-facing service. While this makes direct exposure from the public internet unlikely, internal users or compromised accounts with low-privileged access could still leverage this flaw to elevate their privileges.

When should I update my Incus installation?

You should prioritize updating to version 7.2.0 or later immediately. First, locate all active Incus deployments and identify the system owners. Once the environment is mapped, coordinate a maintenance window to apply the update, as this version contains the necessary logic to safely handle image and backup file paths.

References

github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.