CVE-2026-48753CWE-73

CVE-2026-48753

Critical · published August 21, 2026

CVSS v3.1

9.9

EPSS

Percentile

53.8

In the wild

Unconfirmed

What it is

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.

The record

Technical detail

CVSS v3.1: 9.9 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00731 · 53.8th percentile
Weakness: CWE-73 · External Control of File Name or Path
Published: 2026-08-21T19:16Z

References (2)

https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc · [email protected]https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

21 AUG 14:34Z
Incus has an arbitrary file write via path traversal in S3 multipart upload
cvelistv5