CVE-2026-48752

Executive Summary

CVE-2026-48752 is a critical path traversal and arbitrary file write vulnerability in Incus, a system container and virtual machine manager. Versions prior to 7.2.0 allow a threat actor to craft a malicious image or instance backup that, when processed by the Incus server, can read or create/write arbitrary files on the host filesystem—potentially leading to arbitrary command execution with elevated privileges. The vulnerability carries a CVSS score of 9.9, reflecting the ease of exploitation and the high impact to confidentiality, integrity, and availability across the entire infrastructure. Organizations running Incus appliances or deployments managing untrusted workloads should treat this as an emergency-patch priority.

Technical Analysis

The vulnerability class is CWE-73 — External Control of File Name or Path — more commonly known as a path traversal flaw. The attack surface is the Incus server's image import and instance backup recovery functionality. When a user initiates an image upload or instance backup restoration, the server extracts archive contents and places them on the host filesystem.

The NVD description states: "a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host." This indicates the archive extraction routine fails to validate or sanitize file path components within the archive, allowing entries with absolute paths or ../ traversal sequences to escape the intended extraction directory. An attacker who controls an image or backup archive can therefore place files anywhere the Incus daemon process can write—including systemd unit files, cron jobs, SSH authorized_keys files, or executable binaries in system directories—and read sensitive host files such as /etc/shadow or TLS certificate material.

The vulnerability requires low-privileged access (PR:L) to the Incus API or administrative interface to upload the malicious archive. However, because the flaw can be triggered remotely (AV:N) without user interaction (UI:N), and the scope is Changed (S:C), the impact extends beyond the Incus daemon to the entire host operating system. If the Incus daemon runs as root—the default for container management—arbitrary file write translates directly to arbitrary command execution with root privileges.

Insufficient technical detail is available in the NVD description regarding the exact archive format or extraction code path. However, the vulnerability mechanism aligns with known historical issues in similar container managers (LXD, Docker) where backup and image import functions failed to sandbox extraction paths.

Exploitation Scenarios

Stage 1 — Reconnaissance / Target Identification The attacker first identifies an exposed Incus API endpoint. Incus listens on TCP port 8443 by default and requires client certificate authentication. Shodan searches such as product:"incus" or "incus" "rest api" can reveal internet-facing instances. A low-privileged account is sufficient, so the attacker may also target Incus instances in shared or multi-tenant environments, or trick an administrative user into importing a malicious image from a public or compromised repository.

Step 2 — Triggering the Flaw Class The attacker crafts a malicious image archive (rootfs tarball format) or an instance backup file. Within the archive, one or more file entries contain path traversal sequences or absolute paths, for example a file entry named ../../etc/cron.d/pwn or /etc/systemd/system/malicious.service. The archive is submitted to the Incus server for import or restoration. The server parses the archive and, due to the path validation flaw, extracts the malicious entry to the designated path on the host rather than confining it within the image/backup staging directory.

Step 3 — Payload / Execution Method At the vulnerability-class level, the payload is a host-side file placement. Common exploitation patterns include:

• Placing a cron job in /etc/cron.d/ that executes a reverse shell or downloads a second-stage payload.
• Writing a systemd service unit that starts on boot or immediately after installation.
• Overwriting /root/.ssh/authorized_keys to enable persistent SSH access.
• Creating a new /etc/sudoers.d/ rule to grant the low-privileged Incus user full sudo rights.
• Writing a malicious binary into /usr/local/bin and triggering execution. No public PoC is available; this attack chain is inferred from the vulnerability class and the NVD description.

Step 4 — Post-Exploitation Impact Once arbitrary command execution is achieved (with the privileges of the Incus daemon, typically root), the attacker has full control of the host. They can enumerate credentials, pivot to other containers or VMs on the same host, steal secrets from other workloads, exfiltrate sensitive data, install persistence mechanisms, and use the compromised host as a staging point for lateral movement into the broader network. Because the CVSS scope is marked as Changed, the compromise of the host does not merely affect the Incus-managed workloads but the entire underlying infrastructure.

Impact Assessment

The maximum CVSS base score of 9.9 underscores the severity. The vector breakdown is:

• Attack Vector: Network — the attack can be performed remotely.
• Attack Complexity: Low — no special conditions or race conditions required; the crafted archive is processed automatically.
• Privileges Required: Low — only a low-privileged user account is needed, not administrator-level access.
• User Interaction: None — no victim action required.
• Scope: Changed — the compromised component (Incus) affects resources beyond its security scope; the host OS and all hosted workloads are at risk.
• Confidentiality/Integrity/Availability: High/High/High — full read/write of host files and denial-of-service potential.

Business impact is critical for any organization running Incus to manage containers or virtual machines, particularly in multi-tenant or shared hosting environments. The ability to read arbitrary host files (including secrets and configuration) and write arbitrary files leading to command execution constitutes a complete host compromise. Data integrity and operational continuity are at risk due to the potential for ransomware-style attacks that encrypt host filesystems or delete infrastructure configuration. The vulnerability is not yet listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no in-the-wild exploitation has been publicly documented at the time of writing.

Detection Guidance

Sigma Rule

title: Incus Image Import Path Traversal Attempt
id: 6f8c2e1a-9b3d-4c77-8a5e-2b4d1f0a9c31
status: experimental
description: Detects path traversal indicators in files ingested via Incus image/backup import.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-48752
author: Valtersit Security Research
date: 2026/02/14
logsource:
  product: linux
  category: file_event
detection:
  selection_path_traversal:
    TargetFilename|contains:
      - '..\'
      - '../'
      - '/etc/'
      - '/root/'
      - '/var/lib/incus'
    Image|contains: 'incus'
  selection_incus_proc:
    Image|endswith:
      - '/incusd'
      - '/incus'
  condition: selection_incus_proc and selection_path_traversal
falsepositives:
  - Legitimate system administration actions using Incus to manage host files
level: high

YARA Rule

rule Incus_Backup_Path_Traversal_CVE_2026_48752
{
    meta:
        author = "Valtersit Security Research"
        date = "2026-02-14"
        description = "Detects archive files containing path traversal patterns targeting Incus import"
        cve = "CVE-2026-48752"
        severity = "critical"

    strings:
        $traversal_short = "../"
        $traversal_abs = "/etc/"
        $traversal_ssh = ".ssh/authorized_keys"
        $traversal_cron = "cron.d/"
        $traversal_shadow = "shadow"
        $archive_magic_zip = { 50 4B 03 04 }
        $archive_magic_gzip = { 1F 8B 08 }

    condition:
        uint32(0) == 0x46445000 or // TAR
        $archive_magic_zip at 0 or
        $archive_magic_gzip at 0 and
        (2 of ($traversal_*) )
}

Suricata IDS Rule

alert http any any -> any any (
  msg:"CVE-2026-48752 Attempted Incus Backup Path Traversal via HTTP";
  flow:established,to_server;
  content:"/1.0/images|0d 0a|";
  http.uri;
  content:"%2e%2e%2f";
  http.uri;
  sid:3700001;
  rev:1;
  metadata:attack_target Server, deployment Perimeter, signature_severity Critical, created_at 2026_02_14;
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-48752;
)

Elastic Detection

sequence by host.name, user.name with maxspan=30s
  [process where event.type == "start" and process.name : ("incusd", "incus") and
   process.args : ("image", "import", "backup", "restore")]
  [file where event.type in ("creation", "change") and
   (file.path : "*/etc/*" or file.path : "*/root/*" or file.path : "*/usr/local*" or
    file.path : "*/var/spool/cron/*") and
   process.name : ("incusd", "tar", "gzip", "xz") and
   not file.path : "/var/lib/incus/*"]

Splunk SPL Query

index=linux sourcetype=linux_audit OR sourcetype=syslog
  | search (process="incusd" OR process="incus" OR process="tar")
  | regex file_path="(^|/)(\.\./)+|(/etc/|/root/|/var/spool/cron/|/usr/local/bin/|/home/.*/\.ssh/)"
  | table _time, host, user, process, file_path, file_name
  | eval vulnerability="CVE-2026-48752"
  | eval severity="critical"
  | where file_path !=""/var/lib/incus/*""

Wazuh OSSEC Rule

<group name="incus_path_traversal,">
  <rule id="100501" level="15">
    <if_sid>530</if_sid>
    <match>incusd|incus</match>
    <description>CVE-2026-48752: Incus process detected writing outside standard image directory</description>
    <field name="file">\.\./|../../|/etc/|/root/|/var/spool/cron/</field>
    <group>incus,path_traversal,cve-2026-48752,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 — LIKELY — The fix is confirmed by two independent sources (Debian package tracker and the upstream Incus advisory).

1. Immediate Mitigations:

   • Immediately upgrade Incus to version 7.2.0 or later. This is the only known remediation for the flaw.
   • If immediate patching is not possible, restrict API access to trusted IP ranges and enforce strict client certificate revocation policies so that only known administrators can upload images or restore backups.
   • Consider disabling image import and backup restoration features temporarily using Incus's configuration capabilities if they are not business-critical.
   • Run the Incus daemon as a non-root user if feasible, leveraging Linux user namespaces and sandboxing to reduce the impact of arbitrary file write to the host.

2. Patch / Upgrade Steps:

   • Debian-based systems: apt update && apt upgrade incus incus-tools (or your distribution's equivalent).
   • Snap-based installs: snap refresh incus.
   • After upgrading, verify the installed version: incus version — confirm it reports 7.2.0 or newer.
   • Review instance backups and image repositories for any signs of tampering; a compromised prior version may have been used to plant attacker-controlled files.

3. Long-Term Hardening:

   • Adopt FedRAMP or CIS-style hardening for the Incus host: run the daemon with SELinux/AppArmor confinement, enable user namespace restrictions, and mount /etc, /root, and other sensitive directories read-only from the host's perspective where practical.
   • Implement file integrity monitoring (AIDE, OSSEC) on host directories that are not expected to change via Incus operations.
   • Periodically audit all images and backups stored in Incus for unexpected or malicious archive entries. Use a dedicated extraction sandbox that resolves symlinks and rejects path traversal before importing to production hosts.
   • Restrict upload privileges to a minimal set of dedicated administrative accounts, and require multi-factor authentication for any API access.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-48752
2. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-48752
3. Incus Official Documentation / Release Notes for version 7.2.0 (referenced by Debian advisory)
4. Incus GitHub Repository — Security Advisory / Issue Tracker
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (entry not present as of this writing; monitor for future updates)

No active exploitation in the wild has been reported, and no threat actor campaigns have been attributed to this CVE at the time of this writing. Organizations should still treat this vulnerability as highly likely to be weaponized given the low complexity of exploitation and the high-value target that container management platforms represent.