CVE Catalog
CVE-2026-48753
CriticalCVSS 9.9Summary
Incus prior to version 7.1.0 has a path traversal vulnerability in the S3 protocol upload endpoint, allowing creation of arbitrary files on the host. This could lead to arbitrary command execution. Version 7.1.0 fixes the issue.
Risk Assessment
An attacker may gain the ability to write files on the host, potentially leading to full system compromise.
Recommendation
Immediately upgrade Incus to version 7.1.0 or later.
Original NVD description (English source)
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.