CVE-2026-48769: Arbitrary File Write and Remote Code Execution via Trusted Image Hash in Canonical LXD and Linux Containers Incus

Vulnerability ID: GHSA-PJFF-C2WC-F6JM

CVSS Score: 9.9

Published: 2026-11-06

A critical path traversal vulnerability caused by improper input validation (CWE-20) exists in the direct image download handler of Canonical LXD and Linux Containers Incus. When an authenticated user requests an image import using the URL source type, the daemon reads the image fingerprint from an untrusted HTTP response header ( Incus-Image-Hash or LXD-Image-Hash ) without validating that it conforms to a SHA-256 format.…