CVE-2026-48755

Incus has an argument injection in backup compression algorithm leading to AFW and ACE

Published Aug 21, 2026 CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Description

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.

Analysis

Technical impact

A flaw in the backup compression configuration handling allows a malformed command line to be injected, permitting the creation or modification of arbitrary files on the host filesystem. This can lead to full command execution on the host because the injected command line runs with elevated privileges. The weakness is a classic example of improper input validation, reflected by CWE-20 and CWE-88.

Affected Systems

The vulnerability affects the Incus system container and virtual machine manager supplied by the lxc:incus vendor. All versions released before 7.1.0 are susceptible; the issue was fixed in version 7.1.0.

Risk and Exploitability

The CVSS score of 9.9 indicates critical severity while the EPSS score of less than 1% signals a low probability of exploitation. Although it is not listed in the CISA KEV catalog, the flaw still enables arbitrary code execution on the host and therefore remains a serious threat. An attacker can trigger the vulnerability by submitting a backup request that contains a crafted compression algorithm string, which is subsequently appended to a shell command without proper escaping.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

lxc

incus

affected

Version	Status	Constraints
`< 7.2.0`	affected	—

canonical

lxd

affected

Version	Status	Constraints
`>= 4.0.0, < 4.0.11`	affected	—
`>= 5.0.0, < 5.0.7`	affected	—
`>= 5.1.0, < 5.21.5`	affected	—
`>= 6.0.0, < 6.9.0`	affected	—

No data.

Vendor Product Versions

Lxc

Incus

Version	Status	Scheme	Platform
`[0,7.2.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Incus to version 7.1.0 or later to eliminate the injection path.
If an upgrade cannot be performed immediately, disable the backup feature or run it under a restricted, non‑privileged user so that any injected commands cannot write to critical areas or execute privileged operations.
Ensure that any future backup configurations validate the compression algorithm against an explicit whitelist and escape any user supplied data before incorporating it into command lines.

Generated by OpenCVE AI on August 26, 2026 at 13:52 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6370-1	incus security update
Debian DSA	DSA-6373-1	lxd security update
Github GHSA	GHSA-v6mj-8pf4-hhw4	Incus has an argument injection in backup compression algorithm leading to AFW and ACE

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.784% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/canonical/lxd/security/advisories/GHSA-fmc8-p6q7-75cc
https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4
https://nvd.nist.gov/vuln/detail/CVE-2026-48755
https://www.cve.org/CVERecord?id=CVE-2026-48755

History

Nov 5, 2026 11:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://github.com/canonical/lxd/security/advisories/GHSA-fmc8-p6q7-75cc

Aug 26, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-88
References		https://nvd.nist.gov/vuln/detail/CVE-2026-48755 https://www.cve.org/CVERecord?id=CVE-2026-48755
Metrics	threat_severity `None`	threat_severity `Critical`

Aug 21, 2026 10:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 21, 2026 5:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Lxc Lxc incus
Vendors & Products		Lxc Lxc incus

Aug 21, 2026 3:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.
Title		Incus has an argument injection in backup compression algorithm leading to AFW and ACE
Weaknesses		CWE-20
References		https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4
Metrics		cvssV3_1 `{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`