CVE-2026-48755Host RCE via Argument Injection in Incus
Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.
View on NVDAnalysis
Incus, a system container and VM manager, contains a critical vulnerability in its backup compression logic. This allow attackers to perform argument injection, resulting in arbitrary file writes and potential command execution on the host machine. Users should upgrade to version 7.1.0 immediately.
Relevant roles
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCWE-20EPSS
No EPSS score yet (CVE may be too fresh).
Technical description
Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.