A flaw in the backup compression configuration handling allows a malformed command line to be injected, permitting the creation or modification of arbitrary files on the host filesystem. This can lead to full command execution on the host because the injected command line runs with elevated privileges. The weakness is a classic example of improper input validation, reflected by CWE-20 and CWE-88.

The vulnerability affects the Incus system container and virtual machine manager supplied by the lxc:incus vendor. All versions released before 7.1.0 are susceptible; the issue was fixed in version 7.1.0.

The CVSS score of 9.9 indicates critical severity while the EPSS score of less than 1% signals a low probability of exploitation. Although it is not listed in the CISA KEV catalog, the flaw still enables arbitrary code execution on the host and therefore remains a serious threat. An attacker can trigger the vulnerability by submitting a backup request that contains a crafted compression algorithm string, which is subsequently appended to a shell command without proper escaping.