VulnerabilityReceived

CVE-2026-48755

Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line.

CRITICAL 9.9EPSS 0.44%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.44%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.

CVSS 3.1: 9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS: 0.44% probability · 37th percentile
CISA KEV: Not listed
Weakness: CWE-20
Source: security-advisories@github.com

References

https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.