Description

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-21T15:16:41.077Z",
  "pubdate": "2026-08-21T15:16:41.077Z",
  "executiveSummary": "An improper input validation vulnerability exists in Incus prior to version 7.1.0, specifically within the handling of user-provided backup compression algorithms.\nThe vulnerability manifests as an argument injection flaw occurring during the construction of command lines used for backup operations.\nAn authenticated attacker capable of initiating backup procedures can exploit this flaw to achieve arbitrary file writes on the host system, which subsequently provides a vector for arbitrary command execution.\nThe affected product is Incus, impacting all versions prior to 7.1.0.\nThe risk implications are severe, as unauthorized file modification and command execution on the host compromise the underlying integrity and confidentiality of the container and virtual machine management infrastructure.\nExploitation requires the ability to supply a malicious backup compression algorithm parameter to the system, translating user-controlled input into insecure system command construction.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper validation and sanitization of user-provided strings specifying the backup compression algorithm within Incus.\nWhen processing backup operations, the application dynamically constructs a command line by concatenating user-supplied input without adequately ensuring that the input is treated strictly as a data parameter rather than executable command flags or arguments.\nThis lack of rigorous input filtering allows an attacker to inject command-line switches or arguments into the execution context of the spawned child process.\nThe vulnerable component is the command-line construction logic responsible for executing compression utilities during backup creation.\nIncus versions prior to 7.1.0 are susceptible to this flaw.\nThe attack flow proceeds as follows: First, the malicious actor crafts a specialized payload disguised as a compression algorithm identifier, incorporating arguments supported by the underlying utility or shell mechanics. Second, the attacker submits this input via the API or command-line interface during a backup operation. Third, Incus integrates the unsanitized string into the constructed command line. Fourth, upon execution of the backup routine, the injected arguments alter the intended behavior of the utility, allowing redirection or specification of output files.\nThis manipulation directly results in an arbitrary file write primitive on the host operating system, enabling the attacker to overwrite critical system files or place executable scripts in privileged locations.\nPost-exploitation impact includes the escalation of privileges or arbitrary command execution on the host running the Incus daemon, entirely bypassing containerization boundaries."
}