External risk intelligence

Incus Backup Argument Injection Allows Arbitrary File Write and Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-48755

Incus is a system container and virtual machine manager typically used for infrastructure management and virtualization. While it manages containers, these services are generally hosted on internal server infrastructure or protected networks and are not intended to be exposed directly to the public internet in common deployment patterns.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in Incus, a system for managing containers and virtual machines. This issue could allow an attacker with limited access to write arbitrary files to the host system, potentially leading to the execution of malicious commands. The vulnerability is present in versions prior to 7.1.0, with version 7.1.0 addressing the problem.

Improper validation allows file writes.
Could lead to host system compromise.
Confirm relevance and ensure software is updated.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access to Incus could exploit this vulnerability by tricking the system into using a malicious compression algorithm when creating a backup. This allows the attacker to inject arbitrary commands into the system's command line, potentially leading to the ability to write any file on the host system, which could then be leveraged for arbitrary command execution.

Authenticated access required.
Malicious backup compression algorithm.
Arbitrary file write, command execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker with low privileges could exploit this vulnerability to write arbitrary files to the host system, potentially leading to the execution of arbitrary commands. This could impact the integrity and availability of the host system.

Host system files.
Improper validation of backup algorithm.
Arbitrary command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Incus is a system container and virtual machine manager, indicating that platform or infrastructure teams are likely responsible for its management and security. The first practical step is to identify all instances of Incus, determine their exposure and criticality, and then assign ownership for remediation.

Platform/Infrastructure teams own resolution.
Verify Incus instance exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Incus and what is it used for?

Incus is an open-source software platform used to manage system containers and virtual machines. It provides an environment where administrators can deploy, run, and scale isolated Linux workloads across server infrastructure, acting as an abstraction layer between the host operating system and the guest environments.

What kind of vulnerability is CVE-2026-48755?

This is an argument injection vulnerability, categorized as CWE-20 (Improper Input Validation). It occurs when the software fails to properly sanitize user-provided input, in this case a compression algorithm, before passing it to a system command. This flaw allows an attacker to manipulate the command line execution, potentially granting them unauthorized ability to write files on the host system.

How can an attacker trigger this Incus flaw?

An attacker must have authenticated access to the Incus system to trigger the issue. They exploit it by supplying a malicious compression algorithm during the backup process. Operations that do not involve initiating a backup or that do not provide input for the compression algorithm do not trigger this specific command injection path.

Is my Incus deployment at risk based on Halo Surface Signal?

Halo Surface Signal identifies Incus as typically residing on internal server infrastructure or protected networks, rather than being exposed directly to the public internet. While the technical risk is high, the likelihood of remote exploitation is generally lower for installations following standard deployment patterns that isolate management services from public access.

How do I fix the vulnerability in my Incus environment?

The primary response is to update your Incus installation to version 7.1.0 or later, which includes the necessary patch to validate compression algorithm inputs. Before updating, identify all running instances of the software within your infrastructure to ensure full coverage and confirm the update is applied across all managed hosts.

References

github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.