by Kastro
Paper/Archive/CVE-2026-48753

CVE-2026-48753

lxc incus — Incus has an arbitrary file write via path traversal in S3 multipart upload

EPSS 0.7%public exploitCVSS 9.9
critical.is priorityof 100
51
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 54.3.543 × 2010.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.

Affected

ProductAffectedFixed inSource
incus< 7.1.0–CNA

Scores by source

GitHub_M (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc