CVE-2026-48755CWE-20

CVE-2026-48755

Critical · published August 21, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
53.8
In the wild
Unconfirmed
What it is

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00731 · 53.8th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-08-21T19:16Z
References (1)
https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 · [email protected]
EPSS history
Timeline
  • 21 AUG 14:37Z
    Incus has an argument injection in backup compression algorithm leading to AFW and ACE
    cvelistv5