An improper input validation flaw in lxc Incus allows authenticated users to perform arbitrary file writes on the host, potentially leading to full system compromise.

This is an input validation vulnerability (CWE-20) that occurs during the processing of backup compression algorithms. An attacker with low-level privileges can inject arbitrary arguments into the command line, resulting in file writes on the host system.

With a CVSS score of 9.9, this vulnerability represents a significant risk to containerized environments. By allowing arbitrary file writes on the host, an attacker can escalate privileges or gain persistent access to the underlying infrastructure, undermining the isolation boundary provided by Incus. This poses a high risk to both the confidentiality and integrity of the host server.

Immediate Action: Upgrade the Incus software to version 7.2.0 or later to ensure the proper validation of input arguments.

Proactive Monitoring: Review system logs for unusual command line executions or unauthorized file modifications in sensitive host directories.

Compensating Controls: Restrict access to the Incus administrative interface to trusted users only and employ strict container security policies to limit host-level interactions.

Public Exploit Available: Unknown (no confirmed public weaponized exploit was identified in the provided sources).

Organizations utilizing Incus should treat this as a high-priority update. Administrators must verify their current version and apply the 7.2.0 patch immediately to prevent potential host-level compromise by authenticated actors.