CVE-2026-48755

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48755", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-22T19:39:05.356Z", "datePublished": "2026-08-21T14:37:25.389Z", "dateUpdated": "2026-11-05T23:36:37.705Z"}, "containers": {"cna": {"title": "Incus has an argument injection in backup compression algorithm leading to AFW and ACE", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4"}, {"name": "https://github.com/canonical/lxd/security/advisories/GHSA-fmc8-p6q7-75cc", "tags": ["x_refsource_MISC"], "url": "https://github.com/canonical/lxd/security/advisories/GHSA-fmc8-p6q7-75cc"}], "affected": [{"vendor": "lxc", "product": "incus", "versions": [{"version": "< 7.2.0", "status": "affected"}]}, {"vendor": "canonical", "product": "lxd", "versions": [{"version": ">= 4.0.0, < 4.0.11", "status": "affected"}, {"version": ">= 5.0.0, < 5.0.7", "status": "affected"}, {"version": ">= 5.1.0, < 5.21.5", "status": "affected"}, {"version": ">= 6.0.0, < 6.9.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T23:36:37.705Z"}, "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue."}], "source": {"advisory": "GHSA-v6mj-8pf4-hhw4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T21:00:19.912339Z", "id": "CVE-2026-48755", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T21:44:16.989Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48755", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T21:00:19.912339Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T21:00:21.179Z"}}], "cna": {"title": "Incus has an argument injection in backup compression algorithm leading to AFW and ACE", "source": {"advisory": "GHSA-v6mj-8pf4-hhw4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": "< 7.2.0"}]}, {"vendor": "canonical", "product": "lxd", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.0.11"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.7"}, {"status": "affected", "version": ">= 5.1.0, < 5.21.5"}, {"status": "affected", "version": ">= 6.0.0, < 6.9.0"}]}], "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4", "name": "https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/canonical/lxd/security/advisories/GHSA-fmc8-p6q7-75cc", "name": "https://github.com/canonical/lxd/security/advisories/GHSA-fmc8-p6q7-75cc", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T23:36:37.705Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48755", "state": "PUBLISHED", "dateUpdated": "2026-11-05T23:36:37.705Z", "dateReserved": "2026-05-22T19:39:05.356Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-21T14:37:25.389Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "incus", "vendor": "lxc", "versions": [{"status": "affected", "version": "< 7.2.0"}]}, {"product": "lxd", "vendor": "canonical", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.0.11"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.7"}, {"status": "affected", "version": ">= 5.1.0, < 5.21.5"}, {"status": "affected", "version": ">= 6.0.0, < 6.9.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue."}, {"lang": "es", "value": "Incus es un gestor de contenedores de sistema y m\u00e1quinas virtuales. Antes de la versi\u00f3n 7.1.0, la validaci\u00f3n inadecuada del algoritmo de compresi\u00f3n de copia de seguridad proporcionado por el usuario conduce a la inyecci\u00f3n de argumentos en la l\u00ednea de comandos construida. Esto conduce a una escritura de archivo arbitraria en el host, posiblemente conduciendo a la ejecuci\u00f3n de comandos arbitraria. La versi\u00f3n 7.1.0 soluciona el problema."}], "id": "CVE-2026-48755", "lastModified": "2026-11-06T01:17:49.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48755", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T21:00:19.912339Z", "version": "2.0.3"}}]}, "published": "2026-08-21T15:16:41.077", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/canonical/lxd/security/advisories/GHSA-fmc8-p6q7-75cc"}, {"source": "security-advisories@github.com", "url": "https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "incus: Incus has an argument injection in backup compression algorithm leading to AFW and ACE", "id": "2521019", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521019"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-88", "details": ["Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.", "A flaw was found in Incus, a container and virtual machine manager. Improper validation of backup compression settings allows argument injection, leading to arbitrary file write on the host and potential command execution."], "mitigation": {"lang": "en:us", "value": "No mitigation is needed as Incus is not shipped in any Red Hat product."}, "name": "CVE-2026-48755", "public_date": "2026-08-21T14:37:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48755\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48755\nhttps://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4"], "statement": "Incus is not shipped in any Red Hat product. The community Fedora package is affected.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "incus", "source": "cna", "vendor": "lxc"}, "product": "incus", "vendor": "lxc"}], "created": "2026-08-21T16:30:06.978363+00:00", "updated": "2026-08-26T14:00:06.052622+00:00", "vendors": ["lxc", "lxc$PRODUCT$incus"]}