CVE-2026-48753: Incus Path Traversal Vulnerability

CVE-2026-48753 Overview

CVE-2026-48753 is a path traversal vulnerability in Incus, an open-source system container and virtual machine manager maintained by the LXC project. The S3 protocol upload endpoint fails to sanitize object keys, allowing an authenticated attacker to write arbitrary files to the host filesystem. Attackers can leverage this primitive to achieve arbitrary command execution on the host running Incus. The flaw affects all versions of Incus prior to 7.1.0, which contains the fix. The weakness is classified under CWE-73: External Control of File Name or Path.

Critical Impact
A low-privileged S3 client can escape the intended storage directory and drop files anywhere on the host, resulting in container escape and remote code execution.

Affected Products

Incus system container and virtual machine manager
All Incus versions prior to 7.1.0
Deployments exposing the Incus S3 protocol upload endpoint

Discovery Timeline

2026-08-21 - CVE-2026-48753 published to the National Vulnerability Database
2026-08-21 - Last updated in NVD database
GHSA-ccjc-4qc3-jxqc - GitHub Security Advisory published by the Incus project

Technical Details for CVE-2026-48753

Vulnerability Analysis

Incus exposes an S3-compatible upload endpoint used by clients to push objects into managed storage buckets. The endpoint accepts object keys from the client and uses them to construct file paths on the host. Prior to version 7.1.0, the endpoint does not properly validate or canonicalize these keys. An attacker who supplies traversal sequences such as ../ in the object key can direct file writes outside the intended bucket directory.

Once an attacker can control the destination path, they can overwrite systemd unit files, cron entries, shell startup scripts, or binaries executed by privileged services. This escalates a file-write primitive into arbitrary command execution on the host. Because Incus typically runs with elevated privileges to manage containers and virtual machines, the resulting execution context is highly privileged.

Root Cause

The root cause is insufficient input validation on user-controlled path components passed to the S3 upload handler. The handler concatenates client-supplied object keys with the storage base directory without rejecting parent directory references or absolute paths. This matches the [CWE-73] pattern, where external input directly controls a file name or path used by the application.

Attack Vector

Exploitation requires network access to the Incus S3 endpoint and valid S3 credentials. The attacker issues an S3 PUT request with an object key that includes directory traversal sequences pointing to a sensitive host location. The upload body becomes the contents of the attacker-chosen file. No user interaction is required, and the scope changes because the impact extends from the Incus service to the underlying host.

The vulnerability manifests in the S3 upload path handling logic. See the Incus GitHub Security Advisory GHSA-ccjc-4qc3-jxqc for technical details.

Detection Methods for CVE-2026-48753

Indicators of Compromise

S3 upload requests containing .., %2e%2e, or absolute paths in the object key parameter
Unexpected new or modified files under /etc, /root, /usr/local/bin, or systemd unit directories on Incus hosts
Incus service logs showing writes to paths outside configured storage pool directories
New cron jobs, SSH authorized_keys entries, or shell profile modifications correlated with S3 endpoint activity

Detection Strategies

Inspect Incus API access logs for S3 PUT requests where the object key contains traversal sequences or unusual encodings
Correlate file creation events on the Incus host with S3 upload request timestamps and source addresses
Baseline the storage pool directory tree and alert on file writes that occur outside expected bucket paths
Deploy runtime file integrity monitoring on critical system directories on hosts running Incus

Monitoring Recommendations

Forward Incus daemon logs and host audit logs to a centralized analytics platform for correlation
Enable Linux auditd rules for open and openat syscalls originating from the Incus process against sensitive paths
Track S3 endpoint authentication events and flag credential use from unexpected networks

How to Mitigate CVE-2026-48753

Immediate Actions Required

Upgrade Incus to version 7.1.0 or later on all hosts running the S3 protocol upload endpoint
Rotate S3 access keys issued by Incus buckets to invalidate any credentials that may have been abused
Audit Incus hosts for unauthorized file modifications, new persistence artifacts, and unexpected privileged processes
Restrict network exposure of the Incus S3 endpoint to trusted management networks until patching is complete

Patch Information

The Incus maintainers fixed the path traversal in version 7.1.0. Operators should upgrade using their distribution package manager or the official Incus release artifacts. Refer to the GitHub Security Advisory GHSA-ccjc-4qc3-jxqc for release details and validation guidance.

Workarounds

Disable the S3 protocol upload endpoint on Incus buckets until the upgrade is applied
Place the Incus S3 endpoint behind a reverse proxy that rejects requests containing .. or encoded traversal sequences in the URI path
Limit S3 credentials to the minimum required buckets and revoke keys for accounts that do not require upload permissions

bash

# Configuration example: disable S3 access on an Incus storage bucket
incus storage bucket set <pool> <bucket> s3.access-key=""
incus storage bucket set <pool> <bucket> s3.secret-key=""

# Verify installed Incus version after upgrade
incus version