CVE-2026-48755

9.9 Critique

Publiée le 21/08/2026 à 17:16 · Modifiée le 15/10/2026 à 21:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.

Traduire en français

Produits concernés

lxc incus

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.9 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-20

Références

https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories