GHSA-PJFF-C2WC-F6JM: CVE-2026-48769: Arbitrary File Write and Remote Code ...

A critical path traversal vulnerability caused by improper input validation (CWE-20) exists in the direct image download handler of Canonical LXD and Linux Containers Incus. When an authenticated user requests an image import using the URL source type, the daemon reads the image fingerprint from an untrusted HTTP response header ( Incus-Image-Hash or LXD-Image-Hash ) without validating that it conforms to a SHA-256 format. This unvalidated string is concatenated directly into a filesystem path via filepath.Join prior to file creation and cryptographic verification, allowing directory traversal sequences to write arbitrary files on the host filesystem as root.

Canonical LXD and Linux Containers Incus fail to validate the Incus-Image-Hash and LXD-Image-Hash HTTP headers during URL-based image imports. Attackers with low-privilege API access can supply path traversal sequences in this header to write arbitrary files as root on the host filesystem (such as /etc/cron.d/ ), resulting in full host remote code execution.

⚠️ Exploit Status: POC

CVE ID : CVE-2026-48769 (GHSA-pjff-c2wc-f6jm / GHSA-f6m5-xw2g-xc4x)

Weakness Class : CWE-20 (Improper Input Validation / Path Traversal)

CVSS v3.1 Score : 9.9 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Attack Vector : Network / Authenticated API (POST /1.0/images with source.type=url)

Impact : Arbitrary Host File Write and Remote Code Execution as root

Exploit Status : Public Proof-of-Concept (PoC) Available

EPSS Score : 0.78% (56.21st Percentile)

CISA KEV Status : Not Listed

Linux Containers Incus

Incus : = 4.0.0, = 5.0.0, = 5.1.0, = 6.0.0, < 6.9.0 (Fixed in: 6.9.0 )

GitHub Advisory (Incus) : Official upstream advisory containing the complete Python Proof-of-Concept exploit script demonstrating host cron RCE.

GitHub Advisory (Canonical LXD) : Canonical LXD security advisory detailing the vulnerability and exploit mechanism.

Mitigation Strategies

Upgrade Linux Containers Incus and Canonical LXD packages to the patched release versions across all container hosts.

Restrict access to the Incus and LXD local Unix domain sockets and remote HTTPS APIs (port 8443) to trusted host administrators only.

Enforce strict outbound egress firewall policies on container hosts to prevent the Incus/LXD daemon from connecting to untrusted HTTP/HTTPS endpoints.

Monitor host filesystem integrity in critical directories such as /etc/cron.d/, /etc/systemd/system/, and /root/.ssh/ for unauthorized file creation.

Identify all hosts running Incus (< 7.2.0) or Canonical LXD (< 4.0.11, < 5.0.7, < 5.21.5, < 6.9.0).

For Incus installations, update the incus package to version 7.2.0 or later via the distribution package manager.

For Canonical LXD installations managed via Snap or system packages, refresh or upgrade to 4.0.11, 5.0.7, 5.21.5, or 6.9.0 depending on the active channel.

Verify the running daemon version using 'incus version' or 'lxc version' and restart the service if required.

Review /etc/cron.d/ and system logs on previously exposed multi-tenant hosts for any indicators of transient file creation or unauthorized image import attempts.

Canonical LXD Security Advisory (GHSA-pjff-c2wc-f6jm)

Incus Security Advisory (GHSA-f6m5-xw2g-xc4x)

Incus 7.2 Release Announcement

National Vulnerability Database (NVD) Record for CVE-2026-48769

CVE.org Authoritative Record for CVE-2026-48769

Linux Containers Forum Release Announcement: Incus 7.2

Canonical LXD GitHub Repository

Linux Containers Incus GitHub Repository

Read the full report for GHSA-PJFF-C2WC-F6JM on our website for more details including interactive diagrams and full exploit analysis.