CVE-2026-48769 is a critical arbitrary file write vulnerability in the Incus client (github.com/lxc/incus/v7/cmd/incusd) affecting versions prior to 7.2.0. The flaw occurs because the client processes a crafted Incus-Image-Hash header from a malicious image server containing path traversal sequences, allowing files to be written outside the intended directory. This file write happens before the SHA-256 hash validation, extending the time an attacker can exploit the vulnerability. Successful exploitation can lead to arbitrary command execution as root on the server, for example by writing cron jobs. The vulnerability is tracked as CWE-20 (Improper Input Validation) and has a CVSS 3.1 score of 9.9 (critical). A proof-of-concept exploit exists but no known active exploitation in the wild has been reported.

The vulnerability allows an attacker controlling a malicious image server to write arbitrary files on the client system outside the intended directory. This can lead to arbitrary command execution with root privileges on the server, such as by writing malicious cron jobs. The impact includes full system compromise of the affected server running the vulnerable Incus client prior to version 7.2.0.

An official fix is available in Incus version 7.2.0. Users should upgrade to version 7.2.0 or later to remediate this vulnerability. Since the vulnerability is patched in this release, no additional mitigation steps are required beyond applying the update.