Incus before version 7.3.0 allows an authenticated user to inject a malicious image containing a metadata.yaml symlink that points to any host path. When the instance metadata API is used, the symlink is dereferenced with root privileges, giving the attacker the ability to read or overwrite arbitrary files on the host. This vulnerability is a classic path traversal and symlink abuse, classified as CWE‑73, and can lead to full control of the system if the attacker can modify configuration or system files.

The Incus container manager when running any version earlier than 7.3.0 is affected. Image imports that contain a metadata.yaml symlink are the primary attack vector. All users with the ability to import custom images can exploit this flaw. The fixed release begins at 7.3.0.

The CVSS score of 9.9 indicates critical severity. No EPSS score is available, and the flaw is not listed in CISA KEV, so current exploit prevalence is uncertain. An attacker must be authenticated to Incus and must be able to import a crafted image; however, once the image is loaded, the metadata API call can be issued from a privileged container or host tool, allowing the symlink to be resolved with root rights. Given the high CVSS and the potential for system compromise, the risk is large and the vulnerability is exploitable under normal usage conditions.