CVE-2026-48753: critical vulnerability in lxc incus
Incus has an arbitrary file write via path traversal in S3 multipart upload
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.9epss 0.7%
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
lxc · incusRelated CVEs — lxc incus
In the same product, most dangerous first.
CVE-2026-23954HIGHIncus container image templating arbitrary host file read and writeEPSS 0.8%CVE-2026-48769CRITICALIncus has an arbitrary file write on its client due to trusted image hashEPSS 0.7%CVE-2026-48755CRITICALIncus has an argument injection in backup compression algorithm leading to AFW and ACEEPSS 0.7%CVE-2026-48752CRITICALIncus has arbitrary file read+write on host via templates/ symlink in malicious imageEPSS 0.7%CVE-2026-48750CRITICALIncus has an arbitrary file write on host via `exec-output` symlink in crafted imageEPSS 0.7%CVE-2026-48749CRITICALIncus has an arbitrary file read+write on host via rootfs/ symlink in malicious imageEPSS 0.7%