CVE-2026-48753

Name of the Vulnerable Software and Affected Versions Incus (affected versions not specified)

Description The S3 protocol upload endpoint is susceptible to path traversal, enabling the creation of arbitrary files on the host system. This occurs because the uploadId variable is appended to the uploads directory without proper sanitization in the internal/server/storage/s3/local/multipart.go file. An attacker can exploit this to write files to sensitive locations, which may lead to arbitrary command execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.