Affected by GO-2025-4115
and 21 other vulnerabilities
GO-2025-4115: Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus
GO-2026-4357: Incus container image templating arbitrary host file read and write in github.com/lxc/incus
GO-2026-4359: Incus container environment configuration newline injection in github.com/lxc/incus
GO-2026-5127: Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus
GO-2026-5168: Incus has Unbounded YAML Metadata Decode via Parsing in github.com/lxc/incus
GO-2026-5252: Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted) in github.com/lxc/incus
GO-2026-5254: Incus has Blind SSRF via Image Import Preflight HEAD in github.com/lxc/incus
GO-2026-5280: Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus
GO-2026-5319: Incus has an OVN TLS Verification that Accepts Peer-Supplied Roots in github.com/lxc/incus
GO-2026-5384: Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus
GO-2026-5397: Incus has a Nil-Pointer Dereference Panic via Bucket Metadata in github.com/lxc/incus
GO-2026-5612: Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus
GO-2026-5742: Incus has Nil Dereferences on Restore via Malformed YAML in github.com/lxc/incus
GO-2026-5798: Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image in github.com/lxc/incus
GO-2026-5799: Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus
GO-2026-5800: Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool} in github.com/lxc/incus
GO-2026-5801: Incus has an arbitrary file write on host via `exec-output` symlink in crafted image in github.com/lxc/incus
GO-2026-5802: Incus has an arbitrary file write via path traversal in S3 multipart upload in github.com/lxc/incus
GO-2026-5803: Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus
GO-2026-5806: Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus
GO-2026-5808: Incus has an argument injection in backup compression algorithm leading to AFW and ACE in github.com/lxc/incus
GO-2026-5810: Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7) in github.com/lxc/incus
CompressedTarReader returns a tar reader from the supplied (optionally compressed) tarball stream.
The unpacker arguments are those returned by DetectCompressionFile().
The returned cancelFunc should be called when finished with reader to clean up any resources used.
This can be done before reading to the end of the tarball if desired.
DetectCompressionFile detects the compression type of a file and returns the tar arguments needed
to unpack the file, compression type (in the form of a file extension), and the command needed
to decompress the file to an uncompressed tarball.
ExtractWithFds runs extractor process under specific AppArmor profile.
The allowedCmds argument specify commands which are allowed to run by apparmor.
The cmd argument is automatically added to allowedCmds slice.
Affected by 
The highest tagged major version is
Documentation
¶
Source Files