The Incus S3 multipart upload implementation in internal/server/storage/s3/local/multipart.go improperly handles user-controlled upload IDs by appending them unsanitized to the uploads directory path. This path traversal vulnerability allows attackers to create or overwrite arbitrary files on the host filesystem. Exploitation can lead to arbitrary command execution by writing malicious cron jobs or other scripts. The vulnerability affects versions prior to 7.1.0. No official patch links are provided in the data, and the vendor has not confirmed a fix in the provided information.

Successful exploitation results in arbitrary file write on the host system, which can be leveraged to execute arbitrary commands with the privileges of the Incus process. This compromises system confidentiality, integrity, and availability, potentially allowing persistent remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the S3 upload endpoint to trusted users only and monitor for suspicious activity related to multipart uploads. Avoid exposing the S3 API publicly or to untrusted networks.