A critical arbitrary file write vulnerability exists in the Incus (LXD) client when it processes a malicious image server's crafted Incus-Image-Hash header. This flaw allows an attacker to write files to arbitrary locations on the server filesystem, potentially leading to root command execution. The vulnerability arises because the client trusts the Incus-Image-Hash header before validating the downloaded image's SHA-256 hash, enabling directory traversal attacks. A proof-of-concept demonstrates writing to /etc/cron.d to achieve remote code execution. This issue is fixed in version 0.0.0-20260630083100-c5184be310b1.