A critical file-write vulnerability in the Incus container manager allows authenticated users to achieve host-level command execution by exploiting symlink handling in the exec output process.

The vulnerability stems from improper validation of the exec-output directory, where a low-privileged authenticated user can redirect output files to arbitrary locations on the host system using symlinks (CWE-73).

By manipulating where command execution output is written, an attacker can overwrite critical system files or inject malicious scripts that the host system may execute. With a CVSS score of 9.9, this flaw poses an extreme risk to host availability and data confidentiality, as it facilitates a sandbox escape.

Immediate Action: Upgrade Incus to version 7.2.0 or later to implement the patch that secures symlink handling in the exec endpoint.

Proactive Monitoring: Review audit logs for unusual file creation events or unexpected symlink usage in the exec-output directories.

Compensating Controls: Limit access to the exec functionality within the container manager to only those users who strictly require it for operational tasks.

Public Exploit Available: Unknown

The severity of this issue necessitates an immediate update to version 7.2.0. Organizations should verify that their container management policies prevent unauthorized access to the exec endpoint to minimize the attack surface until the update is deployed.