Incus: [Unknown description] (CVE-2026-48753)
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.
AI Analysis
Technical Summary
Incus before version 7.1.0 contains a critical path traversal vulnerability (CWE-73) in its S3 multipart upload endpoint. The upload ID parameter is not properly sanitized and is directly appended to the uploads directory path. This allows an attacker with limited privileges to write arbitrary files anywhere on the host filesystem. A proof-of-concept shows that an attacker can overwrite sensitive files like /etc/cron.d, enabling persistent arbitrary command execution. The vulnerability has a CVSS 3.1 score of 9.9, reflecting its critical impact on confidentiality, integrity, and availability.
Potential Impact
An attacker with limited privileges can exploit this vulnerability to write arbitrary files on the host system, including sensitive system files. This can lead to persistent arbitrary command execution, compromising system confidentiality, integrity, and availability.
Mitigation Recommendations
A patch is available that fixes this vulnerability. Users should upgrade Incus to version 7.1.0 or later to remediate this issue. No other mitigation guidance is provided or necessary as the vulnerability is addressed by the official fix.
Incus: [Unknown description] (CVE-2026-48753)
Description
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.
CVSS v3.1
Score 9.9critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Incus before version 7.1.0 contains a critical path traversal vulnerability (CWE-73) in its S3 multipart upload endpoint. The upload ID parameter is not properly sanitized and is directly appended to the uploads directory path. This allows an attacker with limited privileges to write arbitrary files anywhere on the host filesystem. A proof-of-concept shows that an attacker can overwrite sensitive files like /etc/cron.d, enabling persistent arbitrary command execution. The vulnerability has a CVSS 3.1 score of 9.9, reflecting its critical impact on confidentiality, integrity, and availability.
Potential Impact
An attacker with limited privileges can exploit this vulnerability to write arbitrary files on the host system, including sensitive system files. This can lead to persistent arbitrary command execution, compromising system confidentiality, integrity, and availability.
Mitigation Recommendations
A patch is available that fixes this vulnerability. Users should upgrade Incus to version 7.1.0 or later to remediate this issue. No other mitigation guidance is provided or necessary as the vulnerability is addressed by the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-ccjc-4qc3-jxqc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-48753"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
Threat ID: 6a3ef78d27e9c79719ff4974
Added to database: 06/26/2026, 22:05:01 UTC
Last enriched: 08/22/2026, 11:09:05 UTC
Last updated: 09/13/2026, 22:01:34 UTC
Views: 119
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.