Incus, a container and virtual machine manager, contains a flaw wherein a specially crafted image can exploit a rootfs/ symlink to read or create and write files on the host system. This arbitrary file manipulation may lead an attacker to execute commands with elevated privileges. The weakness aligns with CWE‑73, representing arbitrary file read/write vulnerabilities.

The affected product is Incus from LXC, specifically all releases prior to version 7.2.0. Any host running these versions that accepts untrusted or user‑submittable images is susceptible.

The flaw carries a CVSS score of 9.9, indicating critical severity, and the EPSS score is not available, but the lack of a KEV listing does not diminish the high intrinsic risk. The likely attack vector is the creation or ingestion of a malicious image by an actor with access to the Incus image registry or import mechanism; once the image is loaded, the symlink can be used to access host files. The vulnerability can be leveraged to obtain arbitrary code execution on the host.