CVE-2026-62867

9.9 Critique

Publiée le 21/08/2026 à 17:16 · Modifiée le 15/10/2026 à 21:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.

Traduire en français

Produits concernés

lxc incus

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.9 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-88

Références

https://github.com/lxc/incus/security/advisories/GHSA-q7xw-r4w2-2wcm

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories