Skip to content
OpenAdvisories
High DSA-6109-1 2 CVEs

incus - security update

Published Jan 23, 2026 · Updated Jan 23, 2026

Fixed packages 1

ReleasePackageFixed in
Debian · 13 incus 6.0.4-2+deb13u4

Vulnerabilities 2

  • High 8.7

    Incus container environment configuration newline injection

    Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration (e.g a member of the ‘incus’ group) can create an environment variable containing newlines, w…

  • High 8.7

    Incus container image templating arbitrary host file read and write

    Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with a custom image (e.g a member of the ‘incus’ group) to use directory traversal or symbolic links in the templating funct…