CVE-2026-48769
Received Received - Intake

Arbitrary File Write in Incus Client Leading to Root Command Execution

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-48769
EUVD
EUVD-2026-63983

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
incus incus to 7.2.0 (exc)
canonical incus to 7.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48769 is a critical vulnerability in the Incus client affecting versions before 7.2.0. It allows arbitrary file write with root privileges due to improper validation of the Incus-Image-Hash header. A malicious image server can send a crafted header with path traversal sequences, causing the client to write files outside the intended directory before validating the downloaded content's hash.

Detection Guidance

Check Incus client version with 'incus version'. If version is below 7.2.0, the system is vulnerable. Monitor network traffic for suspicious Incus-Image-Hash headers containing path traversal sequences like ../../../../.

Impact Analysis

This vulnerability can lead to arbitrary command execution as root on the server. An attacker could write malicious files to sensitive locations like cron jobs, enabling full system compromise. The attack requires low privileges and no user interaction, making it highly dangerous for affected systems.

Mitigation Strategies

Upgrade Incus client to version 7.2.0 or later immediately. If upgrading is not possible, avoid using untrusted image servers and disable network access to Incus client until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48769. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart