There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Incus is a system container and virtual machine manager. Prior to version 7.1.0,
    `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded
    `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot entry in an imported custom-
    volume backup. An authenticated user with `can_create_storage_volumes` permission on any project can crash
    the `incusd` daemon by uploading a backup tarball whose `volume_snapshots[*].expires_at` field is absent.
    This is a sibling-field variant of GHSA-r7w7-mmxr-47r9 (CVE-2026-40197). Commit
    `985a1dedf9f3e7ba729c93b654905ed510de25c2` added `if s == nil` at the top of the loop body, but did not
    guard the adjacent `*snapshot.ExpiresAt` deref 19 lines later. Every other consumer of
    `Config.VolumeSnapshots[i].ExpiresAt` in this same file already gates the deref with a nil-check — the
    asymmetric guard is the bug. Version 7.1.0 contains an updated patch. (CVE-2026-48756)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write
    exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This
    can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.
    (CVE-2026-48769)

  - Incus is a system container and virtual machine manager. Prior to version 7.1.0,
    `(*backend).CreateInstanceFromBackup` in `internal/server/storage/backend.go` contains a nil-pointer
    dereference that an authenticated user with permission to create instances in any project can trigger
    remotely by uploading a crafted backup tarball. The Incus daemon panics and the process crashes, causing
    denial of service to every project on that cluster member. This is a sibling of `GHSA-fwj8-62r8-8p8m`,
    `GHSA-r7w7-mmxr-47r9`, and `GHSA-x5r6-jr56-89pv` (all assigned 2026-05-04). Those patches added guards on
    adjacent fields of the same `backup/config.Config` struct; the `Volume` field on the instance-import path
    was missed. Version 7.1.0 contains an updated patch. (CVE-2026-47753)

  - Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image
    can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command
    execution. Version 7.2.0 fixes the issue. (CVE-2026-48749)

  - Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output`
    parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output`
    directory of the instance. If `exec-output` is a symlink, file named `exec_UUID.stdout` and
    `exec_UUID.stderr` can be written to an arbitrary location where the `.stdout` file will contain arbitrary
    content. This behavior can be abused for arbitrary command execution. Version 7.2.0 contains a patch.
    (CVE-2026-48750)

  - Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore
    the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus
    server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.
    (CVE-2026-48751)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Incus 是一個系統容器和虛擬機器管理器。在版本 7.1.0之前，'（*後端）。'internal/server/storage/backend.go' 中的 CreateCustomVolumeFromBackup' 包含不受保護的 '*time.在匯入的自訂磁碟區備份中，每個磁碟區快照項目的「ExpiresAt」欄位上顯示「時間」解除參照。對任何專案具有「can_create_storage_volumes」權限的已驗證使用者都可以透過上傳缺少「volume_snapshots[*].expires_at」欄位的備份 tarball 來使「incusd」守護程式崩潰。
    這是 GHSA-r7w7-mmxr-47r9 （CVE-2026-40197） 的兄弟場變體。提交 '985a1dedf9f3e7ba729c93b654905ed510de25c2' 在迴圈主體的頂端新增了 'if s == nil'，但沒有保護相鄰的 '*snapshot.ExpiresAt' deref 19 行後。'Config.VolumeSnapshots[i] 的所有其他消費者。ExpiresAt' 已經使用 nil 檢查非對稱保護是錯誤。版本 7.1.0 包含更新的修補程式。（CVE-2026-48756）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Incus 是一个系统容器和虚拟机管理器。低于版本 7.1.0， '（*backend）。“internal/server/storage/backend.go”中的“CreateCustomVolumeFromBackup”包含未保护的“*time.导入的自定义卷备份中每个卷快照条目的“ExpiresAt”字段中的“Time”取消引用。在任何项目上具有“can_create_storage_volumes”权限的经认证用户都可通过上传缺少“volume_snapshots[*].expires_at”字段的备份 tarball 使“incusd”后台程序崩溃。
    这是 GHSA-r7w7-mmxr-47r9 （）CVE-2026-40197 的同级域变体。提交“985a1dedf9f3e7ba729c93b654905ed510de25c2”在循环正文顶部添加了“if s == nil”，但不保护相邻的“*snapshot.ExpiresAt' deref 19 行后。“Config.VolumeSnapshots[i] 的每个其他使用者。ExpiresAt' 时，已经通过 nil-check（非对称防护是错误）保护了 deref。版本 7.1.0 包含更新后的修补程序。（CVE-2026-48756）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Incus はシステムコンテナであり、仮想マシンマネージャです。バージョン 7.1.0 より前は、「(*backend)「internal/server/storage/backend.go」の中の CreateCustomVolumeFromBackup」に、無防備な「*time.インポートされたカスタムボリュームバックアップの各ボリュームスナップショットエントリの「ExpiresAt」フィールドの「Time」逆参照。いずれかのプロジェクトに対して「can_create_storage_volumes」権限を持つ認証されたユーザーは、「volume_snapshots[*].expires_at」フィールドがないバックアップ tarball をアップロードすることで「incusd」デーモンをクラッシュさせる可能性があります。
    これは、GHSA-r7w7-mmxr-47r9(CVE-2026-40197)のsibling-fieldバリアントです。コミット「985a1dedf9f3e7ba729c93b654905ed510de25c2」がループ本文の先頭に「if s == nil」を追加しましたが、隣接する「*snapshot.ExpiresAt」を 19 行後に逆参照します。「Config.VolumeSnapshots[i]」のその他すべてのコンシューマー。ExpiresAt」はすでに deref を nil チェックでゲートしていますが、非対称ガードがバグです。バージョン 7.1.0 には更新されたパッチが含まれています。(CVE-2026-48756)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Incus is a system container and virtual machine manager. Prior to version 7.1.0,     `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded     `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot entry in an imported custom-     volume backup. An authenticated user with `can_create_storage_volumes` permission on any project can crash     the `incusd` daemon by uploading a backup tarball whose `volume_snapshots[*].expires_at` field is absent.
    This is a sibling-field variant of GHSA-r7w7-mmxr-47r9 (CVE-2026-40197). Commit     `985a1dedf9f3e7ba729c93b654905ed510de25c2` added `if s == nil` at the top of the loop body, but did not     guard the adjacent `*snapshot.ExpiresAt` deref 19 lines later. Every other consumer of     `Config.VolumeSnapshots[i].ExpiresAt` in this same file already gates the deref with a nil-check  the     asymmetric guard is the bug. Version 7.1.0 contains an updated patch. (CVE-2026-48756)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
443997	SCA: security update for github.com/lxc/incus/v7/cmd/incusd (GHSA-xhqx-mgh3-3h7q)	Tenable Cloud Security	SCA Checks	2026/6/26	2026/8/24	medium
444651	Alpine: multiple incus packages: security update to 7.0.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2026/7/11	2026/8/24	high
443997	SCA: security update for github.com/lxc/incus/v7/cmd/incusd (GHSA-xhqx-mgh3-3h7q)	Tenable Self-Hosted Container Security	SCA Checks	2026/6/26	2026/8/24	medium
444651	Alpine: multiple incus packages: security update to 7.0.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2026/7/11	2026/8/24	high
317816	Linux Distros 未修補弱點：CVE-2026-48756	Nessus	Misc.	2026/5/29	2026/10/29	medium
317816	Linux Distros 未修补的漏洞：CVE-2026-48756	Nessus	Misc.	2026/5/29	2026/10/29	medium
317816	Linux Distros のパッチ未適用の脆弱性: CVE-2026-48756	Nessus	Misc.	2026/5/29	2026/10/29	medium
317816	Linux Distros Unpatched Vulnerability : CVE-2026-48756	Nessus	Misc.	2026/5/29	2026/10/29	medium

偵測

搜尋 Plugin

medium

high

medium

high

medium

medium

medium

medium