CVE-2026-48755

CVSS 9.9 (critical) · published 2026-08-21

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.

Weakness: CWE-20

Source: NVD CVE-2026-48755

References

• https://github.com/canonical/lxd/security/advisories/GHSA-fmc8-p6q7-75cc
• https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.