VulnerabilityReceived

CVE-2026-48753

Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host.

CRITICAL 9.9EPSS 0.71%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.71%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.

CVSS 3.1: 9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS: 0.71% probability · 52th percentile
CISA KEV: Not listed
Weakness: CWE-73
Source: security-advisories@github.com

References

https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc
https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.