CVE-2026-48753

Published: Aug 21, 2026Modified: Aug 21, 2026

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.

Related CWEs

CWE-73

External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

References (2)

https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc

Source: security-advisories@github.com

https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.