CVE-2025-52890

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-528916.5ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2 CVE-2025-528926.5EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 CVE-2025-528934.5OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. Ope CVE-2025-528947.5OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. Ope CVE-2025-528957.5Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially cra CVE-2025-528965.4Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted CVE-2025-528976.1GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious lin CVE-2025-528988.8Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicio CVE-2025-528995.3Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior CVE-2025-52906.4The Borderless – Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter CVE-2025-529005.5File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2025-529016.5File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit