CVE-2026-48753 lxc CVE debrief

Who should care

System administrators and security teams using Incus versions prior to 7.1.0 should verify exposure and consider upgrading to 7.1.0 or later. This vulnerability has a high impact on system administrators and security teams, as it can lead to potential command execution on affected systems. Affected users should review their systems and prioritize upgrading to version 7.1.0 or later to mitigate the risk.

Why it matters

CVE-2026-48753 is a critical vulnerability in Incus that allows path traversal and arbitrary file creation, potentially leading to command execution. System administrators and security teams should verify exposure, especially for Incus versions prior to 7.1.0, and consider upgrading to mitigate the risk.

• Potential for arbitrary command execution on affected systems
• Need for verification of Incus version and exposure
• Priority for upgrading to version 7.1.0 or later
• Monitoring for suspicious activity on affected systems

Technical summary

Incus system container and virtual machine manager is vulnerable to path traversal via the S3 protocol upload endpoint. This allows creation of arbitrary files on the host, potentially leading to arbitrary command execution. The issue is addressed in Incus version 7.1.0. The vulnerability has a CVSS score of 9.9 and a severity of CRITICAL. Affected users should verify their exposure and consider upgrading to version 7.1.0 or later to mitigate the risk of potential command execution on affected systems. Limited evidence is available, and defenders should verify affected scope and exposure.

Defensive priority

High priority for systems using Incus versions prior to 7.1.0; verify and upgrade to 7.1.0 or later.

Recommended defensive actions

• Verify Incus version and assess exposure
• Upgrade to Incus version 7.1.0 or later
• Monitor for suspicious activity on affected systems
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its fix. Vendor advisories and CVE Program records support the issue and resolution. The vulnerability was reported by [email protected] and affects Incus versions prior to 7.1.0. Limited evidence is available, and defenders should verify affected scope and exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.