Critical severity · published Aug 21, 2026
CVE-2026-48755
Incus has an argument injection in backup compression algorithm leading to AFW and ACE
9.9
CVSS
0.7%
EPSS
No
On KEV
Description
Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
incus · lxc
< 7.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48755
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48755
github.com
https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4
More from incus
9.9
CVE-2026-115377
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream
9.9
CVE-2026-115375
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes
9.9
CVE-2026-63343
Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
9.9
CVE-2026-63125
Incus vulnerable to root RCE via image backup.yaml symlink
9.9
CVE-2026-62941
Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge