Incus: [GHSA-7fj9-65v4-rp7h: Arbitrary file write on host via image-planted symlinks and oci.dns. (CVE-2026-81494)

The vulnerability identified as CVE-2026-81494 in Incus involves arbitrary file write capabilities on the host system. This is achieved through specially crafted container images that plant symbolic links combined with newline injection in the oci.dns file. This flaw allows an attacker to write files arbitrarily on the host, potentially leading to unauthorized modification or compromise of host files. The affected versions are explicitly listed, covering various releases including 0.4-1ubuntu1, 0.5.1-1, 0.5.1-3, 0.6-1, 6.0.0-1 and its Ubuntu variants, 6.0.5-8, 7.0.1-5, and 6.0.4-2. No detailed CVSS vector or vendor advisory is provided, and no known exploits have been reported.

Successful exploitation of this vulnerability allows an attacker to write arbitrary files on the host system where Incus is running. This could lead to unauthorized modification of system files, potential privilege escalation, or persistence mechanisms. However, no active exploitation has been reported, and the severity is assessed as medium based on the ability to write files arbitrarily.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict the use of untrusted container images and monitor for suspicious activity related to image handling. Follow vendor updates closely for any official fixes or workarounds.