CVE-2026-63125: Incus vulnerable to root RCE via image backup.yaml symlink
Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with cancreateimages and cancreateinstances) can execute arbitrary code as root on the host. A crafted image ships backup.yaml as a symlink to a host file. When the root daemon writes the instance's backup file, it follows the symlink. Version 7.3.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Incusto a version that resolves this vulnerability.Fixed in 7.3.0 - Compensating control
Until all Incus nodes are upgraded to 7.3.0, avoid allowing an unprivileged, project-confined Incus user (non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) to execute image backup flows that would cause the root daemon to write an instance backup file and follow the backup.yaml symlink.
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker needs a non-admin Incus TLS or RBAC identity that is confined to a project and has both can_create_images and can_create_instances permissions. No administrator-level Incus access is required.
What systems are exposed?
Incus deployments running a version before 7.3.0 are affected where an eligible project-confined user can create both images and instances. The vulnerable operation is performed by the root-running Incus daemon on the host.
What is the impact of successful exploitation?
A successful attacker can cause arbitrary code execution as root on the Incus host. The issue can affect confidentiality, integrity, and availability beyond the attacker's assigned project.
How can this be remediated?
Upgrade Incus to version 7.3.0. The provided data does not identify a workaround for environments that cannot immediately upgrade.