CVE-2026-48753 Incus has an arbitrary file write via path traversal in S3 multipart upload
Attackers can write arbitrary files via S3 path traversal in Incus, potentially leading to command execution on the host.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48753?
CVE-2026-48753 is a critical path traversal vulnerability in lxc incus, published on 21 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.
Weakness: CWE-73
Which versions are affected by CVE-2026-48753?
5 open source packages ship an affected version, including github.com/lxc/incus/v7/cmd/incusd, github.com/lxc/incus and github.com/lxc/incus/v6.
| Package | Affected | Fixed in |
|---|---|---|
github.com/lxc/incus/v7/cmd/incusd Go | All versions | 7.1.0 |
github.com/lxc/incus/v7/cmd/incusd Go | All versions | 7.1.0 |
github.com/lxc/incus Go | All versions | None |
github.com/lxc/incus/v6 Go | All versions | None |
github.com/lxc/incus/v7 Go | All versions | 7.1.0 |
How do I fix CVE-2026-48753?
Upgrade github.com/lxc/incus/v7/cmd/incusd to 7.1.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-48753 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48753 exists.
Sources
Also known as DEBIAN-CVE-2026-48753, GHSA-ccjc-4qc3-jxqc, GO-2026-5802, UBUNTU-CVE-2026-48753.