CyberRota Analysis
AI-GeneratedA critical vulnerability exists in Incus prior to version 7.3.0, where improper validation of user-provided `block.create_options` allows project-scoped users to inject arbitrary arguments into commands executed with root privileges during filesystem creation. This could lead to unauthorized access and manipulation of the system. Organizations using affected versions should prioritize upgrading to version 7.3.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.