CVE-2026-48755
Received Received - Intake

Arbitrary File Write via Backup Compression in Incus

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-48755
EUVD
EUVD-2026-63982

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
canonical incus to 7.1.0 (exc)
canonical incus to 7.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48755 is a critical vulnerability in Incus versions prior to 7.1.0. It involves improper validation of user-provided backup compression algorithms, allowing argument injection in command construction. This leads to arbitrary file writes on the host and potential arbitrary command execution.

Detection Guidance

Check Incus version with 'incus version' to see if it is below 7.2.0. Monitor for unexpected file writes in system directories like /etc/cron.d/ or /var/lib/incus. Review backup commands for unusual compression algorithm parameters.

Impact Analysis

An attacker could exploit this to write arbitrary files on the host system, including sensitive locations like /etc/cron.d/. This could allow them to execute commands remotely, escalate privileges, or compromise the host system.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or system compromise, violating confidentiality and integrity requirements in GDPR and HIPAA. It may result in non-compliance due to potential exposure of sensitive data.

Mitigation Strategies

Upgrade Incus to version 7.2.0 or later immediately. Restrict user permissions to prevent unauthorized backup operations. Disable backup features if not required. Monitor for signs of exploitation such as unexpected files in critical directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48755. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart