CVE-2026-48753: Incus arbitrary file write via path traversal in S3 multipart upload

Executive brief

Incus, a container and virtual machine management tool, contains a vulnerability in its S3-compatible storage service. An attacker with basic access to create storage buckets can write files to any location on the host server's filesystem. This could allow an attacker to take full control of the host machine, potentially leading to data theft or a complete service shutdown.

Technical details

A path traversal vulnerability exists in the Incus S3 protocol upload endpoint within `internal/server/storage/s3/local/multipart.go`. The root cause is the lack of sanitization for the user-provided `uploadID` parameter, which is directly appended to the uploads directory path. An attacker with valid S3 credentials can provide a manipulated `uploadID` containing traversal sequences (e.g., `../../`) to write arbitrary file content to sensitive host locations, such as `/etc/cron.d`. This can be leveraged to achieve arbitrary command execution on the host with root privileges. The issue is fixed in version 7.1.0.

Affected products

• LinuX Containers (LXC) Incus < 7.1.0

Timeline

• 2026-05-28: disclosed
• 2026-06-26: advisory: GitHub Advisory published
• 2026-06-26: patched: Version 7.1.0 released

References

• https://api.github.com/users/antifob
• https://github.com/antifob
• https://api.github.com/users/antifob/gists%7B/gist_id%7D
• https://api.github.com/users/antifob/repos
• https://avatars.githubusercontent.com/u/25389335?v=4
• https://api.github.com/users/antifob/events%7B/privacy%7D