CVE-2026-48753
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.
- CVSS 3.1
- 9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-25)
- CWE
- CWE-73
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ccjc-4qc3-jxqc | Go | github.com/lxc/incus/v7/cmd/incusd | <7.1.0 | 7.1.0 |
| GO-2026-5802 | Go | github.com/lxc/incus | all versions | no fix published |
| GO-2026-5802 | Go | github.com/lxc/incus/v6 | all versions | no fix published |
| GO-2026-5802 | Go | github.com/lxc/incus/v7 | <7.1.0 | 7.1.0 |