{"schema_version":1,"title":"Linux Containers Project Incus vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 7 vulnerabilities in Linux Containers Project Incus: 0 in the last 7 days and 7 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-63343, was published on 21 August 2026.","url":"https://junglewise.ai/threats/technologies/incus","json_url":"https://junglewise.ai/threats/technologies/incus.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/incus","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":0,"all_time":7,"critical":4,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":7,"last_365_days":7},"latest":[{"cve":"CVE-2026-63343","cvss":9.9,"epss":0.0048,"slug":"cve-2026-63343-incus-arbitrary-file-read-write-via-metadata-yaml-symlink","title":"Incus arbitrary file read/write via metadata.yaml symlink","severity":"critical","exploited":false,"published_at":"2026-08-21T15:16:46.577+00:00","url":"https://junglewise.ai/threats/cve-2026-63343-incus-arbitrary-file-read-write-via-metadata-yaml-symlink"},{"cve":"CVE-2026-63125","cvss":9.9,"epss":0.0066,"slug":"cve-2026-63125-incus-arbitrary-file-write-via-backup-yaml-symlink","title":"Incus arbitrary file write via backup.yaml symlink","severity":"critical","exploited":false,"published_at":"2026-08-21T15:16:46.427+00:00","url":"https://junglewise.ai/threats/cve-2026-63125-incus-arbitrary-file-write-via-backup-yaml-symlink"},{"cve":"CVE-2026-48756","cvss":4,"epss":0.0038,"slug":"cve-2026-48756-lxc-incus-nil-pointer-dereference-in-createcustomvolumefrombackup","title":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/serv","severity":"medium","exploited":false,"published_at":"2026-08-21T15:16:41.21+00:00","url":"https://junglewise.ai/threats/cve-2026-48756-lxc-incus-nil-pointer-dereference-in-createcustomvolumefrombackup"},{"cve":"CVE-2026-48754","cvss":4,"epss":0.0038,"slug":"cve-2026-48754-incus-nil-pointer-dereference-in-createdependentvolumesfrombackup","title":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/","severity":"medium","exploited":false,"published_at":"2026-08-21T15:16:40.943+00:00","url":"https://junglewise.ai/threats/cve-2026-48754-incus-nil-pointer-dereference-in-createdependentvolumesfrombackup"},{"cve":"CVE-2026-48753","cvss":9.9,"epss":0.0073,"slug":"cve-2026-48753-incus-arbitrary-file-write-via-path-traversal-in-s3-multipart","title":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path trave","severity":"critical","exploited":false,"published_at":"2026-08-21T15:16:40.8+00:00","url":"https://junglewise.ai/threats/cve-2026-48753-incus-arbitrary-file-write-via-path-traversal-in-s3-multipart"},{"cve":"CVE-2026-48752","cvss":9.9,"epss":0.0073,"slug":"cve-2026-48752-incus-arbitrary-file-read-and-write-via-templates-symlink","title":"Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to","severity":"critical","exploited":false,"published_at":"2026-08-21T15:16:40.667+00:00","url":"https://junglewise.ai/threats/cve-2026-48752-incus-arbitrary-file-read-and-write-via-templates-symlink"},{"cve":"CVE-2026-47753","cvss":4,"epss":0.0015,"slug":"cve-2026-47753-lxc-incus-nil-pointer-dereference-in-createinstancefrombackup","title":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateInstanceFromBackup` in `internal/server/s","severity":"medium","exploited":false,"published_at":"2026-08-21T15:16:40.067+00:00","url":"https://junglewise.ai/threats/cve-2026-47753-lxc-incus-nil-pointer-dereference-in-createinstancefrombackup"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":4,"exploited":0,"vulnerabilities":7},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Linux Containers Project Incus","slug":"incus","vendor":{"name":"Linux Containers Project","slug":"linux-containers-project","url":"https://junglewise.ai/threats/vendors/linux-containers-project"},"aliases":[],"category":"hypervisor","homepage":"https://linuxcontainers.org/incus/","repo_url":"https://github.com/lxc/incus","description":"Incus is a community-driven system container and virtual machine manager derived from LXD.","url":"https://junglewise.ai/threats/technologies/incus"},"most_severe":[{"cve":"CVE-2026-48753","cvss":9.9,"epss":0.0073,"slug":"cve-2026-48753-incus-arbitrary-file-write-via-path-traversal-in-s3-multipart","title":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path trave","severity":"critical","exploited":false,"published_at":"2026-08-21T15:16:40.8+00:00","url":"https://junglewise.ai/threats/cve-2026-48753-incus-arbitrary-file-write-via-path-traversal-in-s3-multipart"},{"cve":"CVE-2026-48752","cvss":9.9,"epss":0.0073,"slug":"cve-2026-48752-incus-arbitrary-file-read-and-write-via-templates-symlink","title":"Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to","severity":"critical","exploited":false,"published_at":"2026-08-21T15:16:40.667+00:00","url":"https://junglewise.ai/threats/cve-2026-48752-incus-arbitrary-file-read-and-write-via-templates-symlink"},{"cve":"CVE-2026-63125","cvss":9.9,"epss":0.0066,"slug":"cve-2026-63125-incus-arbitrary-file-write-via-backup-yaml-symlink","title":"Incus arbitrary file write via backup.yaml symlink","severity":"critical","exploited":false,"published_at":"2026-08-21T15:16:46.427+00:00","url":"https://junglewise.ai/threats/cve-2026-63125-incus-arbitrary-file-write-via-backup-yaml-symlink"},{"cve":"CVE-2026-63343","cvss":9.9,"epss":0.0048,"slug":"cve-2026-63343-incus-arbitrary-file-read-write-via-metadata-yaml-symlink","title":"Incus arbitrary file read/write via metadata.yaml symlink","severity":"critical","exploited":false,"published_at":"2026-08-21T15:16:46.577+00:00","url":"https://junglewise.ai/threats/cve-2026-63343-incus-arbitrary-file-read-write-via-metadata-yaml-symlink"},{"cve":"CVE-2026-48756","cvss":4,"epss":0.0038,"slug":"cve-2026-48756-lxc-incus-nil-pointer-dereference-in-createcustomvolumefrombackup","title":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/serv","severity":"medium","exploited":false,"published_at":"2026-08-21T15:16:41.21+00:00","url":"https://junglewise.ai/threats/cve-2026-48756-lxc-incus-nil-pointer-dereference-in-createcustomvolumefrombackup"},{"cve":"CVE-2026-48754","cvss":4,"epss":0.0038,"slug":"cve-2026-48754-incus-nil-pointer-dereference-in-createdependentvolumesfrombackup","title":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/","severity":"medium","exploited":false,"published_at":"2026-08-21T15:16:40.943+00:00","url":"https://junglewise.ai/threats/cve-2026-48754-incus-nil-pointer-dereference-in-createdependentvolumesfrombackup"},{"cve":"CVE-2026-47753","cvss":4,"epss":0.0015,"slug":"cve-2026-47753-lxc-incus-nil-pointer-dereference-in-createinstancefrombackup","title":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateInstanceFromBackup` in `internal/server/s","severity":"medium","exploited":false,"published_at":"2026-08-21T15:16:40.067+00:00","url":"https://junglewise.ai/threats/cve-2026-47753-lxc-incus-nil-pointer-dereference-in-createinstancefrombackup"}],"generated_at":"2026-09-26T16:07:00.132667+00:00"}