CVE-2026-48755

CVE-2026-48755 is an argument injection vulnerability in Incus's backup compression feature. The developers implemented user-chosen compression algorithms but failed to validate what arguments could be appended to the compression command. This is not a case of lazy concatenation—they attempted validation (the algorithm name was checked against an allowlist), but the validation logic never considered that `gzip -h` or `zstd --version` are valid invocations that also expose the injection vector. The vulnerability exists because Go's os/exec package requires explicit argument slicing, which is the correct approach but counter-intuitive to developers accustomed to shell string interpolation. The path of least resistance—building command strings with fmt.Sprintf—produces exactly this bug. The CVSS 9.9 rating requires context. Arbitrary file write is confirmed, but the chain to arbitrary command execution depends on deployment context. In Incus specifically, the blast radius is significant: Incus manages system containers and VMs, so file write to /var/lib/incus or container mount points can achieve persistence or cross-container effects without needing a second-stage payload. However, in a hardened container with no cron jobs and read-only filesystem overlays, that write may not translate to execution. Your priority: verify whether the 7.1.0 patch switched to pure-Go compression libraries (the strongest fix), implemented strict argument allowlisting (acceptable), or merely added more restrictive input parsing (inadequate). Check any other subsystems accepting user-chosen program names for similar patterns—this vulnerability class follows a predictable evolution: hardcoded binary → parameterization → partial validation → false confidence. The next instance is likely already latent wherever Go developers face the same structural pressure to accept format-flexible input.

Reviewed through automated stages and approved by a human before publication.