Is CVE-2026-48753 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48753 being exploited in the wild.

How severe is CVE-2026-48753?

Critical severity, with a CVSS score of 9.9, published 21 August 2026.

Which products and versions are affected?

github.com/lxc/incus (Go) SEMVER:introduced=0; github.com/lxc/incus/v6 (Go) SEMVER:introduced=0; github.com/lxc/incus/v7 (Go) SEMVER:introduced=0,fixed=7.1.0; github.com/lxc/incus/v7/cmd/incusd (Go) < 7.1.0, SEMVER:introduced=0,fixed=7.1.0.

Is there a fix for CVE-2026-48753?

Yes. github.com/lxc/incus/v7 (Go): upgrade to 7.1.0 or later; github.com/lxc/incus/v7/cmd/incusd (Go): upgrade to 7.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48753 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-48753?

Check whether you run github.com/lxc/incus (Go), github.com/lxc/incus/v6 (Go), github.com/lxc/incus/v7 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48753: Incus arbitrary file write via path traversal in S3 multipart upload

Q: Is there a fix for CVE-2026-48753?

Yes. github.com/lxc/incus/v7 (Go): upgrade to 7.1.0 or later; github.com/lxc/incus/v7/cmd/incusd (Go): upgrade to 7.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48753 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-48753?

Check whether you run github.com/lxc/incus (Go), github.com/lxc/incus/v6 (Go), github.com/lxc/incus/v7 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48753 · Severity: critical · CVSS 9.9 · Published 2026-08-21

Incus, a container and virtual machine management tool, contains a vulnerability in its S3-compatible storage service. An attacker with basic access to create storage buckets can write files to any location on the host server's filesystem. This could allow an attacker to take full control of the host machine, potentially leading to data theft or a complete service shutdown.

Technologies: github.com/lxc/incus (Go), github.com/lxc/incus/v6 (Go), github.com/lxc/incus/v7 (Go), github.com/lxc/incus/v7/cmd/incusd (Go). Vendors: Go.

Quick answers

Is CVE-2026-48753 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48753 being exploited in the wild.
How severe is CVE-2026-48753?: Critical severity, with a CVSS score of 9.9, published 21 August 2026.
Which products and versions are affected?: github.com/lxc/incus (Go) SEMVER:introduced=0; github.com/lxc/incus/v6 (Go) SEMVER:introduced=0; github.com/lxc/incus/v7 (Go) SEMVER:introduced=0,fixed=7.1.0; github.com/lxc/incus/v7/cmd/incusd (Go) < 7.1.0, SEMVER:introduced=0,fixed=7.1.0.
Is there a fix for CVE-2026-48753?: Yes. github.com/lxc/incus/v7 (Go): upgrade to 7.1.0 or later; github.com/lxc/incus/v7/cmd/incusd (Go): upgrade to 7.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48753 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48753?: Check whether you run github.com/lxc/incus (Go), github.com/lxc/incus/v6 (Go), github.com/lxc/incus/v7 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/lxc/incus/v7 (Go): upgrade to 7.1.0 or later
```
go get github.com/lxc/incus/v7@v7.1.0
```
github.com/lxc/incus/v7/cmd/incusd (Go): upgrade to 7.1.0 or later
```
go get github.com/lxc/incus/v7/cmd/incusd@v7.1.0
```

Technical details

A path traversal vulnerability exists in the Incus S3 protocol upload endpoint within `internal/server/storage/s3/local/multipart.go`. The root cause is the lack of sanitization for the user-provided `uploadID` parameter, which is directly appended to the uploads directory path. An attacker with valid S3 credentials can provide a manipulated `uploadID` containing traversal sequences (e.g., `../../`) to write arbitrary file content to sensitive host locations, such as `/etc/cron.d`. This can be leveraged to achieve arbitrary command execution on the host with root privileges. The issue is fixed in version 7.1.0.

Affected products

LinuX Containers (LXC) Incus < 7.1.0

Identifiers

CVE-2026-48753
GHSA-ccjc-4qc3-jxqc
GO-2026-5802

Timeline

2026-05-28: disclosed
2026-06-26: advisory: GitHub Advisory published
2026-06-26: patched: Version 7.1.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.