CVE-2026-48753

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc
https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc

Configurations

No configuration.

History

15 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Incus es un gestor de contenedores de sistema y máquinas virtuales. Antes de la versión 7.1.0, el punto final de carga del protocolo S3 es vulnerable a salto de ruta y permite la creación de archivos arbitrarios en el anfitrión. Este comportamiento podría llevar a la ejecución arbitraria de comandos. La versión 7.1.0 corrige el problema.

Information

Published : 2026-08-21 15:16

Updated : 2026-10-15 19:10

NVD link : CVE-2026-48753

Mitre link : CVE-2026-48753

CVE.ORG link : CVE-2026-48753

JSON object : View

Products Affected

No product.

CWE

CWE-73

External Control of File Name or Path

{"id": "CVE-2026-48753", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48753", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T15:36:20.469182Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": "< 7.1.0"}]}]}], "published": "2026-08-21T15:16:40.800", "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc", "source": "security-advisories@github.com"}, {"url": "https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue."}, {"lang": "es", "value": "Incus es un gestor de contenedores de sistema y m\u00e1quinas virtuales. Antes de la versi\u00f3n 7.1.0, el punto final de carga del protocolo S3 es vulnerable a salto de ruta y permite la creaci\u00f3n de archivos arbitrarios en el anfitri\u00f3n. Este comportamiento podr\u00eda llevar a la ejecuci\u00f3n arbitraria de comandos. La versi\u00f3n 7.1.0 corrige el problema."}], "lastModified": "2026-10-15T19:10:00.173", "sourceIdentifier": "security-advisories@github.com"}