p PatchFirst

CVE-2026-63343

CVE-2026-63343 · Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The `exec-output` and `templates/` paths were patched in a prior release using `Lstat` rejection and `os.OpenRoot` confinement; `metadata.yaml` was not included in either patch and remains exploitable. Version 7.3.0 patches the issue.

CVSS 9.9 · Critical · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • incus

    Versions
    • < 7.3.0: Affected

    No fix published

  • incus Debian:13

    Versions
    • 6.0.4-2
    • 6.0.4-2+deb13u1
    • 6.0.4-2+deb13u1~bpo12+1
    • 6.0.4-2+deb13u2
    • 6.0.4-2+deb13u2~bpo12+1
    • 6.0.4-2+deb13u3
    • 6.0.4-2+deb13u3~bpo12+1
    • 6.0.4-2+deb13u4
    • 6.0.4-2+deb13u4~bpo12+1
    • 6.0.4-2+deb13u5
    • 6.0.4-2+deb13u5~bpo12+1
    • 6.0.4-2+deb13u6
    • 6.0.4-2+deb13u6~bpo12+1
    • 6.0.4-2+deb13u7
    • 6.0.4-2+deb13u7~bpo12+1
    • 6.0.4-2+deb13u8
    Affected ranges
    • ECOSYSTEM: < 6.0.4-2+deb13u9

    Update to 6.0.4-2+deb13u9

  • incus Debian:14

    Versions
    • 6.0.4-2
    • 6.0.4-3
    • 6.0.5-1
    • 6.0.5-2
    • 6.0.5-3
    • 6.0.5-4
    • 6.0.5-5
    • 6.0.5-6
    • 6.0.5-7
    • 6.0.5-8
    • 6.0.6-1
    • 6.0.6-2
    • 6.0.6-3
    • 6.14.0-1~exp1
    • 6.15.0-1~exp1
    • 6.16.0-1~exp1
    • 6.17.0-1~exp1
    • 6.20.0-1~exp1
    • 6.21.0-1~exp1
    • 6.22.0-1~exp1
    • 6.23.0-1~exp1
    • 7.0.0-1
    • 7.0.0-1~bpo13+1
    • 7.0.0-2
    • 7.0.0-2~bpo13+1
    • 7.0.0-3
    • 7.0.0-4
    • 7.0.0-5
    • 7.0.0-5~bpo13+1
    • 7.0.1-1
    • 7.0.1-1~bpo13+1
    • 7.0.1-2~bpo13+1
    Affected ranges
    • ECOSYSTEM: < 7.0.1-2

    Update to 7.0.1-2

  • incus Ubuntu:Pro:24.04:LTS

    Versions
    • 0.4-1ubuntu1
    • 0.5.1-1
    • 0.5.1-3
    • 0.6-1
    • 6.0.0-1
    • 6.0.0-1ubuntu0.1
    • 6.0.0-1ubuntu0.2
    • 6.0.0-1ubuntu0.2+esm1
    • 6.0.0-1ubuntu0.3
    • 6.0.0-1ubuntu0.3+esm1
    • 6.0.0-1ubuntu0.3+esm2
    • 6.0.0-1ubuntu0.3+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • incus Ubuntu:26.10

    Versions
    • 6.0.5-8
    • 7.0.1-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • incus Ubuntu:Pro:26.04:LTS

    Versions
    • 6.0.4-2
    • 6.0.5-8
    • 6.0.5-8ubuntu0.26.04.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →