CVE-2026-48755
CriticalCVSS 9.9Summary
Incus prior to version 7.1.0 has a vulnerability where improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution.
Risk Assessment
An attacker can write arbitrary files on the host, potentially leading to arbitrary command execution and full system compromise.
Recommendation
Update Incus to version 7.1.0 or later, which includes a fix for this issue.
Original NVD description (English source)
Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.