Description

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The `exec-output` and `templates/` paths were patched in a prior release using `Lstat` rejection and `os.OpenRoot` confinement; `metadata.yaml` was not included in either patch and remains exploitable. Version 7.3.0 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-21T15:16:46.577Z",
  "pubdate": "2026-08-21T15:16:46.577Z",
  "executiveSummary": "An arbitrary file read and overwrite vulnerability exists in the Incus system container and virtual machine manager prior to version 7.3.0.\nThe flaw allows an authenticated Incus user to read or overwrite any file on the host system as root via the instance metadata API by supplying a malicious image containing a specially crafted symbolic link.\nThe vulnerability stems from incomplete input validation and lack of proper path traversal confinement on the metadata.yaml file during image processing.\nWhile prior patches successfully secured the exec-output and templates/ paths using Lstat rejection and os.OpenRoot confinement, metadata.yaml was omitted from these controls, leaving an exploitable vector.\nSuccessful exploitation grants an attacker full root-level read and write capabilities across the host filesystem, introducing severe risks to host integrity, confidentiality, and privilege escalation.\nAttack execution requires authentication within the Incus environment and the ability to provision or import a malicious container or virtual machine image containing the offending symlink payload.",
  "technicalDetails": "The vulnerability resides within the image processing and instance metadata API handling mechanisms of Incus.\nThe root cause is the failure to properly sanitize or restrict path resolution for the metadata.yaml file within image archives, allowing it to contain a symbolic link pointing to an arbitrary path on the host filesystem.\nPrior security updates implemented defensive measures including Lstat rejection and os.OpenRoot confinement targeting the exec-output and templates/ paths, but these mitigations were not applied to metadata.yaml.\nThe attack flow begins when an authenticated user imports or utilizes a malicious image configured with a metadata.yaml symlink targeting sensitive host files.\nWhen the instance metadata API interacts with or parses the metadata.yaml file, the underlying system follows the symbolic link without adequate validation.\nThis behavior enables the attacker to force the application to read arbitrary files from the host and return their contents through the instance metadata API, or alternatively overwrite arbitrary host files depending on the file operation context.\nBecause the daemon or API handling these operations executes with root privileges, the resulting file read and overwrite actions occur with root-level access permissions on the host.\nThe affected component is the image handling and metadata API subsystem within Incus versions prior to 7.3.0.\nExploitation requires authenticated access to the Incus instance manager and the capability to supply a crafted image payload."
}