CVE-2026-48753

CVSS 9.9 (critical) · published 2026-08-21

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.

Weakness: CWE-73

Source: NVD CVE-2026-48753

References

• https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc
• https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.