CVE-2026-48769: LXC Incus arbitrary file write via image hash path traversal

Executive brief

Incus, a container and virtual machine management tool, is vulnerable to a flaw that allows a malicious image server to write files anywhere on the host system. By tricking the software into downloading a specially crafted image, an attacker can gain full administrative (root) control over the server. This could lead to complete system takeover, data theft, or permanent disruption of services.

Technical details

A path traversal vulnerability exists in the Incus daemon (incusd) when handling image downloads via the 'direct' protocol (source.type=url). The daemon trusts the 'Incus-Image-Hash' HTTP header provided by the remote server and uses it as a filename via filepath.Join without adequate validation. An attacker can provide a hash containing '../' sequences to escape the intended image directory and write arbitrary content to the host filesystem. Because the SHA-256 validation occurs only after the file has been created and populated, and cleanup is delayed until the connection closes, an attacker can achieve persistent code execution (e.g., via cron) before the daemon identifies the mismatch. This is patched in version 7.2.0.

Affected products

• LXC Incus < 7.2.0

Timeline

• 2026-06-25: advisory
• 2026-06-26: patched

References

• https://api.github.com/users/antifob
• https://github.com/antifob
• https://api.github.com/users/antifob/gists%7B/gist_id%7D
• https://api.github.com/users/antifob/repos
• https://avatars.githubusercontent.com/u/25389335?v=4
• https://api.github.com/users/antifob/events%7B/privacy%7D