Security readout for executives and security teams
Plain-English summary
A low-privileged Incus user may manipulate a backup compression setting to make the host write arbitrary files and potentially execute commands. Successful exploitation could compromise confidentiality, integrity, and availability beyond the user’s normal permissions. The supplied data rates this critical, but contains conflicting affected-version information.
Executive priority
Treat as an urgent remediation item for Incus environments, especially multi-tenant or delegated-administration deployments. The potential crosses from a low-privileged management user to host compromise. Prioritize inventory, privilege restriction, and vendor-confirmed upgrading. Do not claim an active incident solely from this disclosure because exploitation in the wild is not established.
Technical view
Incus insufficiently validates a user-provided backup compression algorithm before inserting it into a constructed command line. This argument-injection flaw can cause arbitrary file writes on the host and may lead to arbitrary command execution. CVSS 3.1 is 9.9 with network access, low complexity, low privileges, no user interaction, and changed scope.
Likely exposure
Exposure is most likely where users with limited Incus privileges can submit backup compression values and trigger the affected backup workflow. Internet reachability increases concern but is not required by the description. The bundle says versions before 7.2.0 are affected while also saying 7.1.0 fixes the issue; confirm the boundary with the vendor advisory.
Exploitation context
The supplied sources do not report active exploitation, and the CVE is not listed as KEV in the bundle. Exploitation requires low privileges and access to the vulnerable backup operation. The impact chain progresses from argument injection to host file writes, with possible command execution; evidence does not establish that command execution is guaranteed.
Researcher notes
The core weakness is CWE-20 improper input validation affecting command-line construction. Arbitrary file write is the directly described consequence; arbitrary command execution is conditional. Investigate the trust boundary around backup compression input and the external command invocation without testing production destructively. Resolve the 7.1.0 versus 7.2.0 discrepancy before declaring systems patched.
Mitigation direction
- Review the vendor advisory and confirm the corrected release because the supplied version boundaries conflict.
- Upgrade affected Incus deployments to a vendor-confirmed fixed version.
- Restrict backup-management privileges to trusted administrators until remediation is complete.
- Limit network access to Incus management interfaces using existing access controls.
- Review vendor guidance for any additional temporary mitigations.
Validation and detection
- Inventory Incus versions across all managed hosts and clusters.
- Compare installed versions against the vendor advisory’s confirmed affected range.
- Identify accounts permitted to configure or initiate backups.
- Review backup configuration changes and host file modifications for unexpected activity.
- Verify remediation in a controlled environment before broad rollout.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-48755 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H3.16GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4CVE reference, GitHub_M · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Input Validation
Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.