CVE-2026-48755
published 2026-08-21CVE-2026-48755: Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to…
PriorityP268critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
0.44%
36.6th percentile
Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | lxc_incus_v7_cmd_incusd | >= 0 < 7.2.0 | 7.2.0 |
| lxc | incus | < 7.2.0 | 7.2.0 |
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_redhat9.9CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Incus has an argument injection in backup compression algorithm leading to AFW and ACE
ghsa·2026-06-26
CVE-2026-48755 [CRITICAL] CWE-20 Incus has an argument injection in backup compression algorithm leading to AFW and ACE
Incus has an argument injection in backup compression algorithm leading to AFW and ACE
### Summary
Improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution.
### Details
Incus validates `compression_algorithm` by parsing it into fields and checking only the first token against an allowlist:
```go
fields, err := shellquote.Split(value)
...
if !slices.Contains([]string{"bzip2", "gzip", "lz4", "lzma", "pigz", "pzstd", "pxz", "tar2sqfs", "xz", "zstd"}, fields[0]) {
return fmt.Errorf("Compression algorithm %q isn't currently supported", fields[0])
}
_, err = exec.LookPath(fields[0])
```
Extra arguments are not rejected. `c
Red Hat
incus: Incus has an argument injection in backup compression algorithm leading to AFW and ACE
vendor_redhat·2026-08-21·CVSS 9.9
CVE-2026-48755 [CRITICAL] CWE-88 incus: Incus has an argument injection in backup compression algorithm leading to AFW and ACE
incus: Incus has an argument injection in backup compression algorithm leading to AFW and ACE
Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.
A flaw was found in Incus, a container and virtual machine manager. Improper validation of backup compression settings allows argument injection, leading to arbitrary file write on the host and potential command execution.
Statement: Incus is not shipped in any Red Hat product. The community Fedora package is affected.
Mitigation: No mitigation is needed as I
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-48755 incus: Incus has an argument injection in backup compression algorithm leading to AFW and ACE [fedora-all]
bugzilla·2026-08-26·CVSS 9.9
CVE-2026-48755 [CRITICAL] CVE-2026-48755 incus: Incus has an argument injection in backup compression algorithm leading to AFW and ACE [fedora-all]
CVE-2026-48755 incus: Incus has an argument injection in backup compression algorithm leading to AFW and ACE [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.
Bugzilla
CVE-2026-48755 incus: Incus has an argument injection in backup compression algorithm leading to AFW and ACE
bugzilla·2026-08-21·CVSS 9.9
CVE-2026-48755 [CRITICAL] CVE-2026-48755 incus: Incus has an argument injection in backup compression algorithm leading to AFW and ACE
CVE-2026-48755 incus: Incus has an argument injection in backup compression algorithm leading to AFW and ACE
Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.
2026-08-21
Published