CVE-2026-48769
CriticalCVSS 9.9Summary
Incus prior to version 7.2.0 has an arbitrary file write vulnerability in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server.
Risk Assessment
An attacker controlling an image server can achieve remote code execution as root on the Incus server, leading to complete system compromise.
Recommendation
Update Incus to version 7.2.0 or later, which includes a fix for this issue.
Original NVD description (English source)
Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.