CVE-2026-48749

Executive Summary

CVE-2026-48749 is a critical arbitrary file read/write vulnerability in Incus, a system container and virtual machine manager, affecting all versions prior to 7.2.0. A specially crafted image, when imported or launched, can be used to read or create/write arbitrary files on the host filesystem, escalating to arbitrary command execution. The vulnerability carries a CVSS score of 9.9, reflecting a network-exploitable flaw (AV:N) with low privilege requirements (PR:L) and a scope change (S:C) that impacts host confidentiality, integrity, and availability. The fix is confirmed in Incus 7.2.0, with patch confidence rated 3/4 (LIKELY) based on two independent sources.

Technical Analysis

The vulnerability resides in Incus's image handling pipeline. Incus supports image-based container and VM provisioning, pulling images from remote repositories or accepting locally uploaded images. The flaw is classified under CWE-73 (External Control of File Name or Path), indicating that the image processing logic fails to sanitize or constrain file paths embedded within the image metadata or payload.

Attack Mechanism: A malicious image can embed path traversal sequences (e.g., ../../) or absolute paths within its configuration or filesystem layout. When Incus processes the image — during import, unpack, or container creation — it follows these attacker-controlled paths when writing image contents to disk or when reading back configuration data. This allows the attacker to:

1. Read arbitrary host files: By crafting an image that references sensitive host paths (e.g., /etc/shadow, /root/.ssh/authorized_keys), the image unpacking routine may expose their contents to the attacker via the container's file system.
2. Write/create arbitrary host files: Conversely, image payloads can be placed at attacker-chosen host paths, overwriting system configuration, dropping SSH keys, or planting cron jobs.
3. Escalate to arbitrary command execution: By overwriting executable files, systemd units, or configuration files that trigger command execution upon reload or restart, an attacker can transition from file write primitive to full remote code execution on the host as the Incus daemon user (typically root or a privileged service account).

The exact code-level issue is not fully disclosed in the NVD description; however, the vulnerability class (CWE-73) and the described impact indicate that the flaw involves insufficient validation of file paths derived from image contents during the unpack or import phase. The attack surface is the Incus REST API or command-line interface, which accepts image uploads or remote image pulls from unauthenticated or low-privileged users.

Attack Surface Details:

• Image Import Endpoint: Accepts tar/compressed image files via incus image import or API calls. No specific endpoint name is provided in the description.
• Remote Image Pull: Users with access to create instances (PR:L) can pull a malicious image from an attacker-controlled remote server if they are tricked into doing so, or a compromised image repository could deliver the crafted payload.
• Container/VM Creation: Launching an instance from the malicious image triggers the vulnerable unpack logic.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H confirms the flaw is remotely exploitable with low complexity, requires only low privileges (a standard Incus user), requires no user interaction, and has a scope change — meaning a successful exploit crosses a trust boundary from the container/VM environment to the host. The impact on confidentiality, integrity, and availability is rated HIGH across the board.

Exploitation Scenarios

Based strictly on the NVD description and the vulnerability class (CWE-73), the following attack chain is inferred. No public PoC is available, so the specifics of the payload structure are based on the described behavior.

Step 1: Reconnaissance / Target Identification An attacker identifies an Incus instance exposed via its REST API (port 8443 by default) or an internally reachable instance. Valid credentials for a low-privileged Incus user are required (PR:L), which could be obtained through credential stuffing, leaked credentials, or internal threats. Alternatively, an attacker with network access to the API who can register an untrusted image source may launch the attack.

Step 2: Triggering the Flaw (Image Crafting and Delivery) The attacker crafts a malicious container image. The image format for Incus includes a root filesystem (e.g., a rootfs.tar), a metadata file (metadata.yaml), and possibly templates. The attacker embeds path traversal sequences or absolute paths within:

• The image's metadata.yaml — fields that specify file paths on the host to be read or written during container creation (e.g., template file paths, mount points).
• The rootfs tar — by crafting symlinks inside the tar archive that point to host paths, exploiting the unpacking routine that follows symlinks outside the intended extraction directory.

The crafted image is then either uploaded directly to the Incus server (incus image import) or hosted on a malicious container image registry that the victim is lured to use.

Step 3: Payload / Execution Method Upon importing or launching the image, Incus's unpacking logic extracts the image contents to the host. Because file paths are externally controlled (CWE-73), the extraction writes files to arbitrary host locations. The attacker can:

• Drop a .ssh/authorized_keys file into /root/.ssh/, granting SSH access to the host as root.
• Overwrite a systemd unit file (e.g., in /etc/systemd/system/) with a malicious definition that executes a reverse shell upon service reload.
• Replace a cron job or /etc/cron.d/ entry to run arbitrary commands periodically.

Step 4: Post-Exploitation Impact Successful exploitation yields arbitrary file read/write on the host, escalating to arbitrary command execution as the Incus daemon user. Given the service's privilege level, the attacker can:

• Read credentials, secrets, and configuration from any host file.
• Install persistent backdoors, rootkits, or cryptocurrency miners.
• Pivot to other systems accessible from the compromised host, leveraging stolen SSH keys or cloud credentials.
• Disrupt availability by corrupting boot files or system configurations.

Inferred attack chain summary: Craft malicious image → deliver to Incus → path traversal during image unpack → arbitrary file write/read on host → escalate to command execution → full host compromise.

Impact Assessment

Business Impact: This vulnerability enables a complete host compromise from a low-privileged Incus user account. The CVSS score of 9.9 (Critical) underscores the severity. The scope change (S:C) means that while the initial compromise is within the Incus management interface, the blast radius extends to the entire underlying operating system and all workloads running on that host.

Affected Systems: All Incus deployments running versions prior to 7.2.0. This includes:

• Standalone Incus server installations.
• Incus clusters where the attack can be executed on any node.
• Multitenant environments where untrusted users are allowed to import or launch images.

Blast Radius:

• Confidentiality (H): All files readable by the Incus daemon (typically root) are exposed, including /etc/shadow, TLS private keys, cloud provider credentials, and other tenant data.
• Integrity (H): Arbitrary file writes permit modification of system binaries, configuration files, services, and other tenants' images or containers.
• Availability (H): An attacker can overwrite critical OS files, causing denial of service; or simply disrupt Incus itself, taking down all hosted workloads.

Propagation Risk: In a clustered Incus environment, an exploited node may be used to access shared storage or management networks, increasing the propagation risk to other nodes.

CVSS Breakdown (from vector): AV:N (remotely accessible), AC:L (no special conditions), PR:L (needs any account), UI:N (no user interaction), S:C (host is fully affected, not just container), C:H/I:H/A:H (maximum impact). The score of 9.9 is near-maximal.

Detection Guidance

The following detection rules target the behavior of crafting or importing malicious images for Incus. As no public exploit code exists, these rules focus on anomalies in image handling, such as unexpected path references, suspicious file contents in image archives, and network connections to untrusted image sources.

Sigma Rule

title: Suspicious Incus Image Import with Path Traversal
status: experimental
description: Detects Incus image import operations where the image metadata or rootfs contains path traversal sequences or absolute paths targeting sensitive host locations.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-48749
author: ValtersIT Threat Intel
date: 2026/02/10
logsource:
    category: process_creation or file_event
    product: linux
detection:
    selection_incus:
        Image|contains:
            - 'incus'
        CommandLine|contains:
            - 'image import'
            - 'image copy'
    selection_path_traversal:
        CommandLine|contains:
            - '..%2f'
            - '%2e%2e%2f'
            - '..\\'
            - '/proc/'
            - '/etc/'
            - '/var/lib/incus'
    condition: selection_incus and selection_path_traversal
level: high
falsepositives:
    - Legitimate images that reference internal path values within metadata for advanced configurations.
tags:
    - attack.t1190
    - cve.2026.48749

YARA Rule

rule CVE_2026_48749_Incus_Image_Path_Traversal
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects Incus image archives (tar) containing path traversal patterns in file entries or symlink targets."
        date = "2026-02-10"
        cve = "CVE-2026-48749"
    strings:
        $tar_entry_traversal = /(?:..\/|\.\.\\|%2e%2e%2f){1,}[^\/]+\/(?:etc|root|var|proc|bin|usr)/ nocase
        $symlink_target = /l..\/l..[^\/]+\/(?:etc|root|var|proc|bin|usr)/ nocase
        $absolute_path_etc = /\/(?:etc|root|var|proc|bin|usr)\// nocase
        $incus_metadata = "metadata.yaml"
    condition:
        (uint32(0) == 0x8B1F or uint32(0) == 0xE52F2A or #tar_entry_traversal > 0) and
        #symlink_target > 0 or #absolute_path_etc > 0
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-48749 - Potential Incus Malicious Image Download"; flow:established,to_server; content:"GET"; http_method; content:"/1.0/images"; http_uri; content:"../"; http_uri; pcre:"/\.\.\/(etc|root|var|proc|bin|usr)/Ui"; classtype:attempted-admin; sid:2026487490; rev:1;)

Note: This rule detects outbound HTTP GET requests to fetch image resources that reference traversal paths in the URL. Adjust to the Incus API base path as needed.

Elastic Detection

sequence by process.executable with maxspan=5s
  [process where event.action == "exec" and process.name : "incus" and process.args : ("import", "copy")]
  [file where event.action == "write" and file.path : ("/etc/*", "/root/*", "/var/lib/incus/*") and not file.path : "/var/lib/incus/images/*"]

This EQL detects an Incus process execution followed by an unexpected file write outside the standard image storage path.

Splunk SPL Query

index=main sourcetype=linux_audit OR sourcetype=linux_secure
| where match(CommandLine, "(?i)(image import|image copy)") AND (match(CommandLine, "(?i)(../|\\\\|\/etc\/|\/root\/|\/proc\/)") OR match(AuditData, "(?i)(../|\\\\|\/etc\/|\/root\/|\/proc\/)"))
| stats count by host, user, CommandLine, AuditData
| sort - _time

Wazuh OSSEC Rule

<group name="incus, cve_2026_48749,">
  <rule id="100487" level="12">
    <if_sid>5001</if_sid>
    <match>incus image import</match>
    <regex>\.\./|/etc/|/root/|/proc/</regex>
    <description>CVE-2026-48749 - Suspicious Incus image import with path traversal indicators.</description>
    <group>incus, cve_2026_48749,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Two independent sources (Debian package tracker and Incus upstream) confirm the fix in version 7.2.0. Debian has published the patched package.

Immediate Mitigations (before patching):

1. Restrict Image Imports: Disable image import for non-admin users. If untrusted users must import images, restrict the API using authentication or IP allowlists.
2. Restrict Network Access: Limit access to the Incus REST API (port 8443) to trusted networks or administrators. Use TLS client certificates for authentication.
3. Audit Existing Images: Review all images currently imported or running for any signs of malicious modification, particularly any that reference host paths. Re-import images from trusted sources if suspicious.
4. Monitor File Integrity: Enable host-level file integrity monitoring (e.g., AIDE, Tripwire) on sensitive directories like /etc, /root, and /usr/local/bin to detect unauthorized modifications.

Patch/Upgrade Steps:

1. Upgrade Incus to version 7.2.0 or later on all nodes. For Debian-based systems: apt update && apt upgrade incus.
2. For other distributions, check the Incus package repository for version 7.2.0 or a distro-specific backport.
3. Restart the Incus daemon after upgrade to ensure the new version is active.
4. Re-import or re-launch all running containers/VMs after the upgrade to confirm they are unaffected.

Long-Term Hardening:

1. Principle of Least Privilege: Ensure Incus user accounts have minimal necessary permissions. Restrict who can import images or create instances.
2. Content Trust: Deploy an image signing system (e.g., Notary, Cosign) and only allow signed images from trusted publishers to be imported.
3. Sandboxing: Consider running Incus in a dedicated VM or container to further isolate the daemon from the host, reducing the impact of future host-level flaws.
4. Network Segmentation: Place the Incus API on a VPN or management VLAN, separate from production networks.
5. Regular Audits: Periodically audit image and instance configurations for malicious or suspicious patterns, especially those referencing host absolute paths.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-48749 — Official CVE record with description, CVSS vector, and references.
2. Incus Security Advisory: https://github.com/lxc/incus/security/advisories/GHSA-xxxx-xxxx-xxxx — (Verify with vendor; provides details of the vulnerability and the fix).
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-48749 — Confirms patched version in Debian repositories and provides package status.
4. Incus Documentation (Image Handling): https://linuxcontainers.org/incus/docs/main/reference/ — Reference for image operations; useful for understanding the attack surface.
5. CWE-73 Reference: https://cwe.mitre.org/data/definitions/73.html — External Control of File Name or Path; describes the vulnerability class.

Threat Actor Activity: No known threat actor campaigns or in-the-wild exploit evidence has been reported for CVE-2026-48749 as of the publication date. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Exploitation likelihood is considered high given the CVSS score, so immediate patching is strongly advised.