CyberRota Analysis
AI-GeneratedUnprivileged users in Incus versions prior to 7.3.0 can exploit a vulnerability that allows them to execute arbitrary code as root on the host by using a crafted image that contains a symlink to a host file in the `backup.yaml`. This critical security flaw poses a significant risk to system integrity and confidentiality, making it essential for organizations using Incus to prioritize upgrading to version 7.3.0 or later to mitigate this threat. All users and administrators of Incus should take immediate action to address this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as root on the host. A crafted image ships `backup.yaml` as a symlink to a host file. When the root daemon writes the instance's backup file, it follows the symlink. Version 7.3.0 patches the issue.