[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-63125":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-21T09:42:53.246Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":207,"aliases":208,"duplicate_of":9,"upstream":211,"downstream":212,"duplicates":213,"related":214,"reserved_at":9,"published_at":215,"modified_at":215,"state":216,"summary":217,"references_raw":224,"kevs":250,"epss":9,"epss_history":251,"metrics":252,"affected":258},"CVE-2026-63125","Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as root on the host. A crafted image ships `backup.yaml` as a symlink to a host file. When the root daemon writes the instance's backup file, it follows the symlink. Version 7.3.0 patches the issue.",null,[11,195],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-59","Improper Link Resolution Before File Access ('Link Following')","The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.","weakness","Draft","Base","Medium",[20,101,162,191],{"id":21,"name":22,"techniques":23},"CAPEC-132","Symlink Attack",[24],{"id":25,"name":26,"tactics":27,"countermeasures":34},"T1547.009","Shortcut Modification",[28,31],{"id":29,"name":30},"TA0110","Persistence",{"id":32,"name":33},"TA0111","Privilege Escalation",[35,40,44,49,53,58,62,66,70,74,78,83,88,92,96],{"id":36,"name":37,"tactic":38},"D3-CF","Content Filtering",{"name":39},"Isolate",{"id":41,"name":42,"tactic":43},"D3-RFAM","Remote File Access Mediation",{"name":39},{"id":45,"name":46,"tactic":47},"D3-FEV","File Eviction",{"name":48},"Evict",{"id":50,"name":51,"tactic":52},"D3-CM","Content Modification",{"name":39},{"id":54,"name":55,"tactic":56},"D3-EFA","Emulated File Analysis",{"name":57},"Detect",{"id":59,"name":60,"tactic":61},"D3-LFP","Local File Permissions",{"name":39},{"id":63,"name":64,"tactic":65},"D3-FIM","File Integrity Monitoring",{"name":57},{"id":67,"name":68,"tactic":69},"D3-DA","Dynamic Analysis",{"name":57},{"id":71,"name":72,"tactic":73},"D3-FA","File Analysis",{"name":57},{"id":75,"name":76,"tactic":77},"D3-CQ","Content Quarantine",{"name":39},{"id":79,"name":80,"tactic":81},"D3-DF","Decoy File",{"name":82},"Deceive",{"id":84,"name":85,"tactic":86},"D3-RF","Restore File",{"name":87},"Restore",{"id":89,"name":90,"tactic":91},"D3-EAL","Executable Allowlisting",{"name":39},{"id":93,"name":94,"tactic":95},"D3-EDL","Executable Denylisting",{"name":39},{"id":97,"name":98,"tactic":99},"D3-FE","File Encryption",{"name":100},"Harden",{"id":102,"name":103,"techniques":104},"CAPEC-17","Using Malicious Files",[105,142],{"id":106,"name":107,"tactics":108,"countermeasures":120},"T1574.005","Executable Installer File Permissions Weakness",[109,110,111,114,117],{"id":29,"name":30},{"id":32,"name":33},{"id":112,"name":113},"TA0030","Defense Evasion",{"id":115,"name":116},"TA0005","Stealth",{"id":118,"name":119},"TA0104","Execution",[121,125,130,134,138],{"id":122,"name":123,"tactic":124},"D3-SU","Software Update",{"name":100},{"id":126,"name":127,"tactic":128},"D3-AVE","Asset Vulnerability Enumeration",{"name":129},"Model",{"id":131,"name":132,"tactic":133},"D3-SWI","Software Inventory",{"name":129},{"id":135,"name":136,"tactic":137},"D3-SBV","Service Binary Verification",{"name":57},{"id":139,"name":140,"tactic":141},"D3-RS","Restore Software",{"name":87},{"id":143,"name":144,"tactics":145,"countermeasures":151},"T1574.010","Services File Permissions Weakness",[146,147,148,149,150],{"id":29,"name":30},{"id":32,"name":33},{"id":112,"name":113},{"id":115,"name":116},{"id":118,"name":119},[152,154,156,158,160],{"id":139,"name":140,"tactic":153},{"name":87},{"id":131,"name":132,"tactic":155},{"name":129},{"id":135,"name":136,"tactic":157},{"name":57},{"id":122,"name":123,"tactic":159},{"name":100},{"id":126,"name":127,"tactic":161},{"name":129},{"id":163,"name":164,"techniques":165},"CAPEC-35","Leverage Executable Code in Non-Executable Files",[166,173,180],{"id":167,"name":168,"tactics":169,"countermeasures":172},"T1027.006","HTML Smuggling",[170,171],{"id":112,"name":113},{"id":115,"name":116},[],{"id":174,"name":175,"tactics":176,"countermeasures":179},"T1027.009","Embedded Payloads",[177,178],{"id":112,"name":113},{"id":115,"name":116},[],{"id":181,"name":182,"tactics":183,"countermeasures":186},"T1564.009","Resource Forking",[184,185],{"id":112,"name":113},{"id":115,"name":116},[187],{"id":188,"name":189,"tactic":190},"D3-FFV","File Format Verification",{"name":39},{"id":192,"name":193,"techniques":194},"CAPEC-76","Manipulating Web Input to File System Calls",[],{"_key":196,"id":196,"name":197,"description":198,"type":15,"status":199,"abstraction":200,"likelihood_of_exploit":201,"capec":202},"CWE-61","UNIX Symbolic Link (Symlink) Following","The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.","Incomplete","Compound","High",[203],{"id":204,"name":205,"techniques":206},"CAPEC-27","Leveraging Race Conditions via Symbolic Links",[],[],[209,210],"UBUNTU-CVE-2026-63125","DEBIAN-CVE-2026-63125",[],[],[],[],"2026-08-21T14:49:16.844Z","PUBLISHED",{"cisa_kev":218,"cisa_ransomware":218,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":219,"severity_score":220,"severity_version":221,"severity_source":222,"severity_vector":223,"severity_status":216},false,"critical",9.9,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",[225,231,235,240,244],{"url":226,"sources":227,"tags":229},"https://ubuntu.com/security/CVE-2026-63125",[228],"osv_ubuntu",[230],"REPORT",{"url":232,"sources":233,"tags":234},"https://www.cve.org/CVERecord?id=CVE-2026-63125",[228],[230],{"url":236,"sources":237,"tags":238},"https://github.com/lxc/incus/security/advisories/GHSA-6rqx-22hc-qm36",[228,222],[230,239],"X Refsource CONFIRM",{"url":241,"sources":242,"tags":243},"https://github.com/lxc/incus/pull/3750",[228],[230],{"url":245,"sources":246,"tags":248},"https://security-tracker.debian.org/tracker/CVE-2026-63125",[247],"osv_debian",[249],"Advisory",[],[],[253],{"source":222,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":254,"cvss_v4_0":9},{"baseScore":220,"baseSeverity":255,"vectorString":223,"impactScore":256,"exploitabilityScore":257},"CRITICAL",10,7.9,[259,274,280],{"ecosystem":260,"name":261,"vendor":262,"product":261,"cpe_part":9,"purl_type":263,"purl_namespace":262,"purl_name":261,"source":9,"versions":264},"Debian","incus","debian","deb",[265,271],{"version":266,"is_range":267,"range_type":268,"version_start":9,"version_start_type":9,"version_end":269,"version_end_type":270,"fixed_in":9},"lt6_0_4_2+deb13u9",true,"ecosystem","6.0.4-2+deb13u9","excluding",{"version":272,"is_range":267,"range_type":268,"version_start":9,"version_start_type":9,"version_end":273,"version_end_type":270,"fixed_in":9},"lt7_0_1_2","7.0.1-2",{"ecosystem":275,"name":261,"vendor":276,"product":261,"cpe_part":9,"purl_type":263,"purl_namespace":276,"purl_name":261,"source":9,"versions":277},"Ubuntu","ubuntu",[278],{"version":279,"is_range":267,"range_type":268,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",{"ecosystem":9,"name":261,"vendor":281,"product":261,"cpe_part":282,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":283},"lxc","a",[284],{"version":285,"is_range":267,"range_type":222,"version_start":9,"version_start_type":9,"version_end":286,"version_end_type":270,"fixed_in":9},"\u003C 7.3.0","7.3.0"]