Vulnerability · Published Aug 21, 2026 · Assigned by GitHub_M
CVE-2026-48753Incus has an arbitrary file write via path traversal in S3 multipart upload
Critical 9.9
In plain English
A critical-severity security flaw in incus from lxc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)0.7%top 45.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | incus | 7.0.1-r0 | ALPINE-CVE-2026-48753 |
| Debian:14 | incus | 7.0.0-2 | DEBIAN-CVE-2026-48753 |
| Go | github.com/lxc/incus | no fix listed | GO-2026-5802 |
| Go | github.com/lxc/incus/v6 | no fix listed | GO-2026-5802 |
| Go | github.com/lxc/incus/v7 | 7.1.0 | GO-2026-5802 |
| Go | github.com/lxc/incus/v7/cmd/incusd | 7.1.0 | GHSA-ccjc-4qc3-jxqc |
| Ubuntu:25.10 | incus | no fix listed | UBUNTU-CVE-2026-48753 |
| Ubuntu:26.10 | incus | no fix listed | UBUNTU-CVE-2026-48753 |
Affected products (as reported)
Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc x_refsource_CONFIRM