A flaw in the backup compression configuration handling allows a malformed command line to be injected, permitting the creation or modification of arbitrary files on the host filesystem. This can lead to full command execution on the host because the injected command line runs with elevated privileges. The weakness is a classic example of improper input validation, reflected by CWE-20.

The vulnerability affects the Incus system container and virtual machine manager supplied by the lxc:incus vendor. All versions released before 7.1.0 are susceptible; the issue was fixed in version 7.1.0.

The CVSS score of 9.9 indicates critical severity and the lack of an EPSS value means the likelihood of exploitation is unknown but potentially high due to the impact. It is not recorded in the CISA KEV catalog, yet the ability to execute arbitrary code on the host makes it a serious threat. An attacker can trigger the flaw by requesting a backup with a crafted compression algorithm string, which is then appended to a shell command without proper escaping.