CVE-2026-48750: Incus Exec-Output Symlink Attack Enables Host File Write (CVSS 9.9)

Overview

A critical vulnerability (CVSS 9.9) in Incus allows a container user or attacker to redirect command execution output files to arbitrary locations on the host filesystem by placing a symlink in the instance's exec-output directory. This symlink attack enables writing attacker-controlled content to host paths, which can be leveraged for privilege escalation or code execution. The vulnerability is tracked as CVE-2026-48750.

Affected versions: Incus prior to 7.2.0. The fix is available in Incus 7.2.0.

Vulnerability Details

Incus provides a record-output parameter on the /instances/$name/exec endpoint. When enabled, the output of the executed command is stored in the exec-output directory of the instance as files named exec_UUID.stdout and exec_UUID.stderr.

The vulnerability arises because Incus does not validate whether exec-output is a symlink before writing these output files. If a container user has placed a symlink at the exec-output path pointing to a directory on the host filesystem, the output files are written to the symlink's target — potentially anywhere the Incus daemon has write access.

Attack Flow

1. Attacker (inside container or with container write access) replaces exec-output/ 
   with a symlink pointing to a sensitive host directory.
   
   e.g.: exec-output -> /etc/cron.d/

2. Incus daemon writes exec_<UUID>.stdout to /etc/cron.d/exec_<UUID>.stdout
   with attacker-controlled content (the output of the exec'd command).

3. If the content is valid cron syntax, it executes on the host.

Content Control

The attacker controls command output by choosing which command Incus executes. With record-output enabled, the attacker effectively controls the content written to the symlink target, making this a write-what-where primitive with meaningful content control.

Impact

• Arbitrary file write on the host filesystem, to any path writable by the Incus daemon (typically running as root).
• Code execution on the host via cronjob injection, SSH key injection, or shared library replacement.
• Exploitation requires the ability to write to the instance's exec-output directory (container filesystem access) and trigger an exec call with record-output.

Affected Products

Relationship to CVE-2026-48749

CVE-2026-48749 and CVE-2026-48750 were disclosed together and both affect Incus prior to 7.2.0. CVE-2026-48749 abuses the image import pathway for arbitrary file read/write; CVE-2026-48750 abuses the exec output recording pathway via symlinks. Both share the fix version (7.2.0) and result in host filesystem write primitives.

Remediation

Update Incus to version 7.2.0 or later. The patch adds a symlink check on the exec-output directory before writing output files, ensuring that output is always written within the container's filesystem boundary.

# Check current Incus version
incus version
 
# Update via snap
snap refresh incus
 
# Or via apt (Zabbly repository)
apt update && apt install incus

Additional mitigations (pre-patch):

• Disable record-output on exec calls unless strictly necessary.
• Restrict which users can trigger exec operations on Incus instances.
• Monitor for unexpected symlinks in instance exec-output directories.

References

• NVD — CVE-2026-48750
• Incus Project
• Incus 7.2.0 Release Notes