{
  "cveId": "CVE-2026-63343",
  "url": "https://patchblox.com/security/cve/CVE-2026-63343",
  "summary": "CVE-2026-63343 is fixed in incus on 1 platform, first by DEBIAN-CVE-2026-63343, released August 1, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "incus: Incus is a system container and virtual machine manager",
  "description": "Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a \u0060metadata.yaml\u0060 symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The \u0060exec-output\u0060 and \u0060templates/\u0060 paths were patched in a prior release using \u0060Lstat\u0060 rejection and \u0060os.OpenRoot\u0060 confinement; \u0060metadata.yaml\u0060 was not included in either patch and remains exploitable. Version 7.3.0 patches the issue.",
  "published": "2026-08-21T15:16:46Z",
  "severity": "critical",
  "cvss": 9.9,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss": 0.00479,
  "epssPercentile": 0.41649,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "incus",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.4-2\u002Bdeb13u9",
      "fix": "DEBIAN-CVE-2026-63343",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-63343",
      "released": "2026-08-01T14:28:19Z"
    },
    {
      "platform": "linux",
      "product": "incus",
      "release": "Debian 14",
      "fixedVersion": "7.0.1-2",
      "fix": "DEBIAN-CVE-2026-63343",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-63343",
      "released": "2026-08-01T14:28:19Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}