CVE-2026-115372: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in lxc incus

Incus from version 7.3.0 before 7.5.0 contains a project restriction bypass vulnerability that permits restricted project users to set the block.create_options parameter through volume update, copy, and move operations. By setting this option on a custom volume and triggering a copy or move operation onto a formatting pool, attackers can inject arguments into the mkfs command, which is executed with root privileges. This improper neutralization of argument delimiters leads to argument injection, enabling attackers to escalate privileges or execute arbitrary commands as root.

The vulnerability allows attackers with restricted project user privileges to escalate their privileges by injecting arguments into the mkfs command executed as root. This can lead to unauthorized command execution with root privileges, posing a critical security risk to affected systems.

The vulnerability affects Incus versions >=7.3.0 and <7.5.0. Users should upgrade to version 7.5.0 or later where this issue is fixed. Since no explicit patch link or vendor advisory was provided, confirm patch availability from the vendor's official sources before applying updates. Until patched, restrict access to volume update, copy, and move operations to trusted users only.