CVE-2026-48755 Incus has an argument injection in backup compression algorithm leading to AFW and ACE
Attackers can inject arguments into backup commands to write arbitrary files and execute code on the host.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48755?
CVE-2026-48755 is a critical command injection vulnerability in lxc incus, published on 21 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.
Weakness: CWE-20
Which versions are affected by CVE-2026-48755?
5 open source packages ship an affected version, including github.com/lxc/incus/v7/cmd/incusd, github.com/lxc/incus and github.com/lxc/incus/v6.
| Package | Affected | Fixed in |
|---|---|---|
github.com/lxc/incus/v7/cmd/incusd Go | All versions | 7.2.0 |
github.com/lxc/incus/v7/cmd/incusd Go | All versions | 7.2.0 |
github.com/lxc/incus Go | All versions | None |
github.com/lxc/incus/v6 Go | All versions | None |
github.com/lxc/incus/v7 Go | All versions | 7.2.0 |
How do I fix CVE-2026-48755?
Upgrade github.com/lxc/incus/v7/cmd/incusd to 7.2.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-48755 being exploited?
There is no known exploitation of CVE-2026-48755 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-48755, GHSA-v6mj-8pf4-hhw4, GO-2026-5808, UBUNTU-CVE-2026-48755.