Path Traversal Vulnerability in Incus System Container and Virtual Machine Manager
CVE-2026-48753

9.9CRITICAL

Key Information:

Vendor

Lxc

Status
Incus
Vendor
CVE Published:
21 August 2026

What is CVE-2026-48753?

Incus, a system container and virtual machine management tool, contains a vulnerability in the S3 protocol upload endpoint that enables path traversal. This flaw permits an attacker to create arbitrary files on the host system, posing a serious risk of arbitrary command execution. Users are encouraged to update to version 7.1.0 or later to mitigate this issue.

Affected Version(s)

incus < 7.1.0

References

https://github.com/lxc/incus/security/advisories/GHSA-ccj...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.