Changes.Watch~ upgrade verdicts ~
Free digest
Securitysshole: password bypass in Alpine’s OpenSSH

critical vulnerability

Incus has arbitrary file read+write on host via templates/ symlink in malicious image

Fix availableCritical · CVSS 9.9EPSS 0.73%

Published Jun 26, 2026 · updated Nov 5, 2026

What to do

  1. Upgrade to a fixed version: github.com/lxc/incus/v7/cmd/incusd 7.2.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Gogithub.com/lxc/incus/v7/cmd/incusd

Vulnerable versions
< 7.2.0
Fixed in
7.2.0

Check your project: go list -m all | grep github.com/lxc/incus/v7/cmd/incusd

Sources

CWE-73 External Control of File Name or Path

← All critical vulnerabilities