CVE-2026-63125: Incus vulnerable to root RCE via image backup.yaml symlink

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-21 · updated 2026-10-15
Weakness: CWE-59

Description

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as root on the host. A crafted image ships `backup.yaml` as a symlink to a host file. When the root daemon writes the instance's backup file, it follows the symlink. Version 7.3.0 patches the issue.

Affected products

lxc incus: before 7.3.0

References

https://github.com/lxc/incus/security/advisories/GHSA-6rqx-22hc-qm36
https://github.com/lxc/incus/security/advisories/GHSA-6rqx-22hc-qm36

Get alerted when CVE-2026-63125 or the next vulnerability affects your stack