CVE-2026-48753
published 2026-08-21CVE-2026-48753: Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows…
PriorityP267critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
0.71%
51.0th percentile
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | lxc_incus_v7_cmd_incusd | >= 0 < 7.1.0 | 7.1.0 |
| lxc | incus | < 7.1.0 | 7.1.0 |
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_redhat9.9CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
incus: Incus has an arbitrary file write via path traversal in S3 multipart upload
vendor_redhat·2026-08-21·CVSS 9.9
CVE-2026-48753 [CRITICAL] CWE-22 incus: Incus has an arbitrary file write via path traversal in S3 multipart upload
incus: Incus has an arbitrary file write via path traversal in S3 multipart upload
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.
A flaw was found in Incus, a container and virtual machine manager. The S3 upload endpoint is vulnerable to path traversal, allowing creation of arbitrary files on the host, potentially leading to command execution.
Statement: Incus is not shipped in any Red Hat product. The community Fedora package is affected.
Mitigation: No mitigation is needed as Incus is not shipped in any Red Hat product.
GHSA
Incus has an arbitrary file write via path traversal in S3 multipart upload
ghsa·2026-06-26
CVE-2026-48753 [CRITICAL] CWE-73 Incus has an arbitrary file write via path traversal in S3 multipart upload
Incus has an arbitrary file write via path traversal in S3 multipart upload
## Summary
The S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution.
In `internal/server/storage/s3/local/multipart.go`, user-controlled upload ID is appended to the uploads directory unsanitized; https://github.com/lxc/incus/blob/40dd4f151d52c06b178482aa2518abfb9df3e6fb/internal/server/storage/s3/local/multipart.go#L33
## PoC
### Setup
```
# Expose the S3 API and create a bucket
incus config set core.storage_buckets_address=:8555
incus storage volume create default bucket
#> note the credentials
```
### Exploitation
The below script was mostly generated.
```
#!/usr/bin/env bash
set -euo pipef
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-48753 incus: Incus has an arbitrary file write via path traversal in S3 multipart upload [fedora-all]
bugzilla·2026-08-26·CVSS 9.9
CVE-2026-48753 [CRITICAL] CVE-2026-48753 incus: Incus has an arbitrary file write via path traversal in S3 multipart upload [fedora-all]
CVE-2026-48753 incus: Incus has an arbitrary file write via path traversal in S3 multipart upload [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.
Bugzilla
CVE-2026-48753 incus: Incus has an arbitrary file write via path traversal in S3 multipart upload
bugzilla·2026-08-21·CVSS 9.9
CVE-2026-48753 [CRITICAL] CVE-2026-48753 incus: Incus has an arbitrary file write via path traversal in S3 multipart upload
CVE-2026-48753 incus: Incus has an arbitrary file write via path traversal in S3 multipart upload
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.
2026-08-21
Published