CVE-2026-48769

Aliases:GHSA-f6m5-xw2g-xc4xGO-2026-5806
Advisory lineage Upstream: 0 Downstream: 3
PUBLISHED
Published: 21 Aug 2026, 14:38
Last modified:21 Aug 2026, 14:38

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.9 CRITICAL
v3.1 (cve.org)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

21 Aug 2026, 14:38
Published
Vulnerability first disclosed

Description

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Techniques & Countermeasures

  • CWE-20•Improper Input Validation

    The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected Systems

  • github.com/lxc•incus

    all

  • github.com/lxc/incus•v6

    all

  • github.com/lxc/incus•v7

    < 7.2.0

  • github.com/lxc/incus/v7/cmd•incusd

    < 7.2.0

  • lxc•incus

    < 7.2.0

References (2)