CVE-2026-48755 affects Incus before version 7.2.0 by allowing argument injection in the backup compression algorithm due to insufficient validation of user input. The vulnerability arises because the software validates only the first token of the compression algorithm against an allowlist, but passes additional arguments directly to the compression command without checks. This enables attackers to inject arbitrary command-line arguments, leading to arbitrary file writes and potentially arbitrary command execution on the host system. A proof-of-concept demonstrates exploitation by writing a malicious cron job file, enabling remote code execution. The vulnerability has a CVSS 3.1 score of 9.9 (critical). A patch is available to fix this issue.

Successful exploitation allows an attacker with limited privileges to inject arbitrary arguments into the compression command, resulting in arbitrary file writes and potentially arbitrary command execution on the host system. This can lead to full system compromise, including remote code execution via malicious cron jobs.

A patch is available for Incus to fix this vulnerability. Users should upgrade to version 7.2.0 or later to remediate the issue. Until patched, avoid using untrusted input for the backup compression algorithm parameter.