CVE-2026-48752 is a critical vulnerability in Incus (github.com/lxc/incus/v7/cmd/incusd) affecting versions before 7.2.0. It allows an attacker to craft a container image or instance backup containing a top-level 'templates' symbolic link. During extraction, this symlink is not rejected, permitting the attacker to map host directories and perform arbitrary file read and write operations on the host. This can lead to modification of sensitive files like cron jobs and potentially arbitrary command execution on the host system. The vulnerability is tracked under CWE-73 (External Control of File Name or Path).

Successful exploitation allows an attacker with the ability to supply container images or backups to read and write arbitrary files on the host system. This can lead to full host compromise through modification of critical files such as cron jobs, enabling arbitrary command execution. The CVSS v3.1 score is 9.9 (Critical), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and complete confidentiality, integrity, and availability impact.

A patch is available that fixes this vulnerability in Incus version 7.2.0. Users should upgrade to version 7.2.0 or later to remediate this issue. Until patched, avoid importing container images or backups from untrusted sources that could contain malicious 'templates' symlinks.