Critical
incus — security advisory
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.
- Products
- incus
- Affected versions
- 0.4-1ubuntu1, 0.5.1-1, 0.5.1-3, 0.6-1, 6.0.0-1, 6.0.0-1ubuntu0.1, 6.0.0-1ubuntu0.2, 6.0.0-1ubuntu0.2+esm1, 6.0.0-1ubuntu0.3, 6.0.0-1ubuntu0.3+esm1, 6.0.0-1ubuntu0.3+esm2, 6.0.0-1ubuntu0.3+esm3, 6.0.3-4, 6.0.4-2, 6.0.5-8, 6.0.5-8ubuntu0.26.04.1~esm1, 7.0.1-5
- Fixed versions
- Not specified
- CVEs
- CVE-2026-48753
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:21 UTC · Revision 1
Source evidence
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.
osv:UBUNTU-CVE-2026-48753
incus
Fixed versions: Not specified
incus
Fixed versions: Not specified
incus
Fixed versions: Not specified
incus
Fixed versions: Not specified
Complete source record
{
"id": "0adb062ca83a7e938e1fa12f0bad0fce536534822d8ed29448944945c27ee4fb",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-48753",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-48753",
"summary": "Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.",
"evidence": "osv:UBUNTU-CVE-2026-48753",
"products": [
{
"name": {
"value": "incus",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.4-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "0.5.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "0.5.1-3",
"evidence": "/affected/0/versions"
},
{
"value": "0.6-1",
"evidence": "/affected/0/versions"
},
{
"value": "6.0.0-1",
"evidence": "/affected/0/versions"
},
{
"value": "6.0.0-1ubuntu0.1",
"evidence": "/affected/0/versions"
},
{
"value": "6.0.0-1ubuntu0.2",
"evidence": "/affected/0/versions"
},
{
"value": "6.0.0-1ubuntu0.2+esm1",
"evidence": "/affected/0/versions"
},
{
"value": "6.0.0-1ubuntu0.3",
"evidence": "/affected/0/versions"
},
{
"value": "6.0.0-1ubuntu0.3+esm1",
"evidence": "/affected/0/versions"
},
{
"value": "6.0.0-1ubuntu0.3+esm2",
"evidence": "/affected/0/versions"
},
{
"value": "6.0.0-1ubuntu0.3+esm3",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "incus",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.0.3-4",
"evidence": "/affected/1/versions"
},
{
"value": "6.0.4-2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "incus",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.0.5-8",
"evidence": "/affected/2/versions"
},
{
"value": "7.0.1-5",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "incus",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.0.4-2",
"evidence": "/affected/3/versions"
},
{
"value": "6.0.5-8",
"evidence": "/affected/3/versions"
},
{
"value": "6.0.5-8ubuntu0.26.04.1~esm1",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "UBUNTU-CVE-2026-48753",
"aliases": [
"UBUNTU-CVE-2026-48753"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "incus",
"purl": "pkg:deb/ubuntu/incus?arch=source&distro=esm-apps%2Fnoble",
"ecosystem": "Ubuntu:Pro:24.04:LTS"
},
"versions": [
"0.4-1ubuntu1",
"0.5.1-1",
"0.5.1-3",
"0.6-1",
"6.0.0-1",
"6.0.0-1ubuntu0.1",
"6.0.0-1ubuntu0.2",
"6.0.0-1ubuntu0.2+esm1",
"6.0.0-1ubuntu0.3",
"6.0.0-1ubuntu0.3+esm1",
"6.0.0-1ubuntu0.3+esm2",
"6.0.0-1ubuntu0.3+esm3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48753.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-lxc-incus-dev",
"binary_version": "6.0.0-1ubuntu0.3+esm3"
},
{
"binary_name": "incus",
"binary_version": "6.0.0-1ubuntu0.3+esm3"
},
{
"binary_name": "incus-agent",
"binary_version": "6.0.0-1ubuntu0.3+esm3"
},
{
"binary_name": "incus-client",
"binary_version": "6.0.0-1ubuntu0.3+esm3"
},
{
"binary_name": "incus-migrate",
"binary_version": "6.0.0-1ubuntu0.3+esm3"
},
{
"binary_name": "incus-tools",
"binary_version": "6.0.0-1ubuntu0.3+esm3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "incus",
"purl": "pkg:deb/ubuntu/incus?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"6.0.3-4",
"6.0.4-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48753.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-lxc-incus-dev",
"binary_version": "6.0.4-2"
},
{
"binary_name": "incus",
"binary_version": "6.0.4-2"
},
{
"binary_name": "incus-agent",
"binary_version": "6.0.4-2"
},
{
"binary_name": "incus-base",
"binary_version": "6.0.4-2"
},
{
"binary_name": "incus-client",
"binary_version": "6.0.4-2"
},
{
"binary_name": "incus-extra",
"binary_version": "6.0.4-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "incus",
"purl": "pkg:deb/ubuntu/incus?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"6.0.5-8",
"7.0.1-5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48753.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-lxc-incus-dev",
"binary_version": "7.0.1-5"
},
{
"binary_name": "incus",
"binary_version": "7.0.1-5"
},
{
"binary_name": "incus-agent",
"binary_version": "7.0.1-5"
},
{
"binary_name": "incus-base",
"binary_version": "7.0.1-5"
},
{
"binary_name": "incus-client",
"binary_version": "7.0.1-5"
},
{
"binary_name": "incus-extra",
"binary_version": "7.0.1-5"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "incus",
"purl": "pkg:deb/ubuntu/incus?arch=source&distro=esm-apps%2Fresolute",
"ecosystem": "Ubuntu:Pro:26.04:LTS"
},
"versions": [
"6.0.4-2",
"6.0.5-8",
"6.0.5-8ubuntu0.26.04.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-48753.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-lxc-incus-dev",
"binary_version": "6.0.5-8ubuntu0.26.04.1~esm1"
},
{
"binary_name": "incus",
"binary_version": "6.0.5-8ubuntu0.26.04.1~esm1"
},
{
"binary_name": "incus-agent",
"binary_version": "6.0.5-8ubuntu0.26.04.1~esm1"
},
{
"binary_name": "incus-base",
"binary_version": "6.0.5-8ubuntu0.26.04.1~esm1"
},
{
"binary_name": "incus-client",
"binary_version": "6.0.5-8ubuntu0.26.04.1~esm1"
},
{
"binary_name": "incus-extra",
"binary_version": "6.0.5-8ubuntu0.26.04.1~esm1"
}
]
}
}
],
"modified": "2026-10-17T12:58:31.540230701Z",
"provider": "osv",
"upstream": [
"CVE-2026-48753"
],
"references": [
"https://ubuntu.com/security/CVE-2026-48753",
"https://www.cve.org/CVERecord?id=CVE-2026-48753",
"https://github.com/lxc/incus/pull/3425",
"https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc"
]
},
"related_cves": [
{
"value": "CVE-2026-48753",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 358693,
"published_at": "2026-08-21T15:16:00+00:00"
}