What is CVE-2026-48755?

CVE-2026-48755 is a critical-severity vulnerability in Lxc Incus, classified under Improper Input Validation. CVSS score: 9.9/10. Published 2026-08-21.

How severe is CVE-2026-48755?

Critical severity. CVSS v3 base score is 9.9 out of 10.

Improper input validation in Lxc Incus

CVE-2026-48755

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Lxc Incus — versions < 7.2.0

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-48755?: CVE-2026-48755 is a critical-severity vulnerability in Lxc Incus, classified under Improper Input Validation. CVSS score: 9.9/10. Published 2026-08-21.
How severe is CVE-2026-48755?: Critical severity. CVSS v3 base score is 9.9 out of 10.