Description

Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory of the instance. If `exec-output` is a symlink, file named `exec_UUID.stdout` and `exec_UUID.stderr` can be written to an arbitrary location where the `.stdout` file will contain arbitrary content. This behavior can be abused for arbitrary command execution. Version 7.2.0 contains a patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-21T15:16:40.390Z",
  "pubdate": "2026-08-21T15:16:40.390Z",
  "executiveSummary": "Incus prior to version 7.2.0 contains an arbitrary file write vulnerability within the `/instances/$name/exec` endpoint when processing the `record-output` parameter. This flaw allows malicious actors to leverage symlink manipulation to write arbitrary data into unintended file locations on the underlying filesystem.\nThe vulnerability affects Incus systems handling instance execution logs and can be exploited to achieve arbitrary command execution under specific conditions. Threat actors require authorization to interact with the vulnerable API endpoint and must be able to manipulate the target directory structure to establish malicious symlinks.\nThe primary risk stems from the potential escalation of privileges or system compromise via unauthorized file modification and arbitrary payload placement. Remediation requires upgrading the affected product to version 7.2.0 or later, where the patch addresses insecure file write operations during command execution recording.",
  "technicalDetails": "The vulnerability resides in the handling of the `record-output` parameter within the `/instances/$name/exec` endpoint of the Incus system container and virtual machine manager. Prior to version 7.2.0, the application writes the standard output and standard error streams of executed commands into the `exec-output` directory of the targeted instance using predictable filenames formatted as `exec_UUID.stdout` and `exec_UUID.stderr`.\nThe root cause of the vulnerability is the lack of proper validation and secure file creation practices when handling the `exec-output` directory and its contents. Specifically, the application fails to verify whether `exec-output` is a symbolic link pointing to an external or sensitive directory on the filesystem. If an attacker can manipulate the `exec-output` path to act as a symlink pointing to an arbitrary location, the file creation routine will blindly traverse the link and write output files to the target destination.\nThe exploitation flow begins with an attacker establishing or influencing a symbolic link at the `exec-output` path pointing to a sensitive system directory or file location. Subsequently, the attacker invokes the `/instances/$name/exec` endpoint with the `record-output` parameter enabled, supplying a payload designed to be written to the execution output streams. As the command executes, the application writes the generated output—containing arbitrary content controlled by the attacker—into the files `exec_UUID.stdout` and `exec_UUID.stderr` located at the arbitrary destination referenced by the symlink.\nBecause the written files contain arbitrary content dictated by the command execution output, this primitive can be leveraged to overwrite existing system files or place executable payloads in strategic locations, ultimately leading to arbitrary command execution. The affected component is the output recording mechanism within the execution subsystem of Incus versions prior to 7.2.0. Exploitation requires access to the API endpoint and the ability to manipulate directory structures within the instance storage context."
}