CVE-2026-48753

EUVD-2026-63980
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Debian logo
Debian Releases
Debian Product
Codename
incus
forky
7.0.1-2
fixed
sid
7.0.1-2
fixed
trixie
6.0.4-2+deb13u8
fixed
trixie (security)
6.0.4-2+deb13u9
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
incus
jammy
dne
noble
needs-triage
questing
ignored
resolute
needs-triage
Common Weakness Enumeration
References
https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc
https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc