github.com/lxc/incus/v7/cmd/incusd (Go)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 7.2.0 or later clears every advisory below that has a fix.

Upgrade commands

go get github.com/lxc/incus/v7/cmd/incusd@v7.2.0 && go mod tidy

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GO-2026-6319 Incus has a project restriction bypass in instance copy across projects	High EPSS 0.34%	`< 7.2.0`	`7.2.0`
GO-2026-5806 Incus has an arbitrary file write on its client due to trusted image hash	Critical EPSS 0.73%	`< 7.2.0`	`7.2.0`
GO-2026-5810 Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)	Low EPSS 0.38%	`< 7.1.0`	`7.1.0`
GO-2026-5808 Incus has an argument injection in backup compression algorithm leading to AFW and ACE	Critical EPSS 0.73%	`< 7.2.0`	`7.2.0`
GO-2026-5800 Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}	Low EPSS 0.38%	`< 7.1.0`	`7.1.0`
GO-2026-5802 Incus has an arbitrary file write via path traversal in S3 multipart upload	Critical EPSS 0.73%	`< 7.1.0`	`7.1.0`
GO-2026-5803 Incus has arbitrary file read+write on host via templates/ symlink in malicious image	Critical EPSS 0.73%	`< 7.2.0`	`7.2.0`
GO-2026-5799 Incus has a restricted project bypass leading to arbitrary command execution	Critical EPSS 0.64%	`< 7.2.0`	`7.2.0`
GO-2026-5801 Incus has an arbitrary file write on host via `exec-output` symlink in crafted image	Critical EPSS 0.73%	`< 7.2.0`	`7.2.0`
GO-2026-5798 Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image	Critical EPSS 0.73%	`< 7.2.0`	`7.2.0`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor