CVE-2026-48769

Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.2.0

Description An arbitrary file write exists in the Incus client. This occurs when a malicious image server returns a specially crafted Incus-Image-Hash header. The client uses this header to determine the destination filename without proper validation, allowing a path traversal attack. This can lead to arbitrary command execution as root on the server. The issue is triggered when the client handles a request with source.type=url, where the imageDownload() function is called and the Incus-Image-Hash is used to build the destination path via filepath.Join(). Because the SHA-256 validation occurs only after the file has been created and populated, an attacker can overwrite critical system files.

Recommendations Update Incus to version 7.2.0.