CVE-2026-48753

Publication date 21 August 2026

Last updated 2 September 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

9.9 · Critical

Score breakdown

Description

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.

Status

Package Ubuntu Release Status
incus 26.04 LTS resolute
Needs evaluation
25.10 questing Ignored end of life, was needs-triage
24.04 LTS noble
Needs evaluation
22.04 LTS jammy Not in release

Severity score breakdown

CVSS version: CVSS v3.0

Base score 9.9 · Critical

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Other references

Access our resources on patching vulnerabilities