CVE-2026-48755

Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.1.0

Description Improper validation of the user-provided backup compression algorithm allows for argument injection in the constructed command line. The system validates the compression algorithm by checking only the first token against an allowlist, failing to reject additional arguments. This flaw allows an attacker to use the compressFile() function to perform an arbitrary file write on the host, which can potentially lead to arbitrary command execution. This can be achieved by passing a crafted string to the compression algorithm variable, such as using zstd with the -o flag to specify a destination file on the host system.

Recommendations Update Incus to version 7.1.0.