Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory of the instance. If `exec-output` is a symlink, file named `exec_UUID.stdout` and `exec_UUID.stderr` can be written to an arbitrary location where the `.stdout` file will contain arbitrary content. This behavior can be abused for arbitrary command execution. Version 7.2.0 contains a patch.

A critical vulnerability exists in Incus, a system container and virtual machine manager, prior to version 7.2.0. The vulnerability resides in the `record-output` parameter of the `/instances/$name/exec` API endpoint. When the `exec-output` directory is a symlink, output files (exec_UUID.stdout and exec_UUID.stderr) can be written to arbitrary filesystem locations. The `.stdout` file can contain arbitrary content controlled by an attacker. This symlink following behavior can be chained to achieve arbitrary command execution on the host system. The vulnerability has been patched in Incus version 7.2.0, which users are advised to upgrade to immediately.