Executive brief
Incus, a container and virtual machine management tool, is vulnerable to a security flaw in its backup system. An attacker with the ability to request backups can inject malicious commands into the compression process. This allows them to write files anywhere on the host server, potentially leading to a full takeover of the system and all hosted virtual environments.
Technical details
An argument injection vulnerability exists in the `incusd` daemon of Incus due to improper validation of the `compression_algorithm` parameter during backup operations. While the software checks that the first token of the user-provided string is an allowed compression utility (e.g., zstd, gzip), it fails to reject additional arguments. These extra fields are appended to the command line executed by the host. An attacker can use flags like `-o` in `zstd` to write arbitrary content to sensitive host locations, such as `/etc/cron.d/`, to achieve remote code execution. This vulnerability is patched in version 7.2.0.
Affected products
- LXC Incus < 7.2.0
Timeline
- 2026-06-25: advisory: Initial GHSA advisory published
- 2026-06-26: patched: Fix released in version 7.2.0