CVEvulnerability

CVE-2026-48753

9.9 CRITICAL Published 2026-08-21 Modified 2026-10-15 Official page ↗
Status
Deferred
Published
2026-08-21
Last modified
2026-10-15
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-73

Description

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.

Related

Weakness · CWE (1)

  • CWE-73 External Control of File Name or Path weakness

References