{"id":"EUVD-2026-63980","enisaUuid":"79a54c8b-b3b3-3542-8772-44aa5ed92e43","description":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.","datePublished":"Aug 21, 2026, 2:34:39 PM","dateUpdated":"Aug 21, 2026, 3:36:43 PM","baseScore":9.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc\n","aliases":"CVE-2026-48753\nGHSA-ccjc-4qc3-jxqc\n","assigner":"GitHub_M","epss":0.73,"enisaIdProduct":[{"id":"75ed71d4-93b2-37c0-804b-40280e643d9d","product":{"name":"incus","vendor":{"name":"lxc"}},"product_version":"\u003c 7.1.0"}],"enisaIdVendor":[{"id":"c3d059d2-ee50-3c09-866b-aead0427509c","vendor":{"name":"lxc"}}],"enisaIdVulnerability":[{"id":"23236f43-974b-3965-9884-47c178ad4da6","vulnerability":{"id":"GHSA-ccjc-4qc3-jxqc","description":"Incus has an arbitrary file write via path traversal in S3 multipart upload","datePublished":"Jun 26, 2026, 6:47:25 PM","dateUpdated":"Jun 26, 2026, 6:47:25 PM","baseScore":0.0,"references":"https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc\nhttps://github.com/lxc/incus\n","enisa_id":"EUVD-2026-63980\n","aliases":"GHSA-ccjc-4qc3-jxqc\nCVE-2026-48753\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"4bc202f2-ad3d-3915-b764-bc3fa0932388","vulnerability":{"id":"CVE-2026-48753","description":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.","datePublished":"Aug 21, 2026, 2:34:39 PM","dateUpdated":"Aug 21, 2026, 3:36:43 PM","status":"PUBLISHED","baseScore":9.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","references":"https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc\n","enisa_id":"EUVD-2026-63980\n","assigner":"GitHub_M","epss":0.73,"dataProcessed":"Oct 28, 2026, 7:18:26 AM","vulnerabilityProduct":[{"id":"d2a2c531-6980-3338-87bf-430a18e3e427","product":{"name":"incus","vendor":{"name":"lxc"}},"product_version":"\u003c 7.1.0"}],"vulnerabilityVendor":[{"id":"cd06b241-6f23-3a4f-aaf5-76e583ff1558","vendor":{"name":"lxc"}}]}}],"enisaIdAdvisory":[{"id":"31f4c67a-b162-32ee-a68e-686074e6d397","advisory":{"id":"openSUSE-SU-2026:11651-1","description":"incus-7.4-1.1 on GA media","summary":"incus-7.4-1.1 on GA media","datePublished":"Aug 31, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 5:22:13 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11651-1.json\nhttps://www.suse.com/security/cve/CVE-2026-39402/\nhttps://www.suse.com/security/cve/CVE-2026-47753/\nhttps://www.suse.com/security/cve/CVE-2026-48749/\nhttps://www.suse.com/security/cve/CVE-2026-48750/\nhttps://www.suse.com/security/cve/CVE-2026-48751/\nhttps://www.suse.com/security/cve/CVE-2026-48752/\nhttps://www.suse.com/security/cve/CVE-2026-48753/\nhttps://www.suse.com/security/cve/CVE-2026-48754/\nhttps://www.suse.com/security/cve/CVE-2026-48755/\nhttps://www.suse.com/security/cve/CVE-2026-48756/\nhttps://www.suse.com/security/cve/CVE-2026-48769/\nhttps://www.suse.com/security/cve/CVE-2026-55621/\nhttps://www.suse.com/security/cve/CVE-2026-55622/\nhttps://www.suse.com/security/cve/CVE-2026-62313/\nhttps://www.suse.com/security/cve/CVE-2026-62867/\nhttps://www.suse.com/security/cve/CVE-2026-62940/\nhttps://www.suse.com/security/cve/CVE-2026-62941/\nhttps://www.suse.com/security/cve/CVE-2026-63125/\nhttps://www.suse.com/security/cve/CVE-2026-63343/\nhttps://www.suse.com/security/cve/CVE-2026-81500/\nhttps://www.suse.com/security/cve/CVE-2026-81501/\n","aliases":"CVE-2026-39402\nCVE-2026-47753\nCVE-2026-48749\nCVE-2026-48750\nCVE-2026-48751\nCVE-2026-48752\nCVE-2026-48753\nCVE-2026-48754\nCVE-2026-48755\nCVE-2026-48756\nCVE-2026-48769\nCVE-2026-55621\nCVE-2026-55622\nCVE-2026-62313\nCVE-2026-62867\nCVE-2026-62940\nCVE-2026-62941\nCVE-2026-63125\nCVE-2026-63343\nCVE-2026-81500\nCVE-2026-81501\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"03a17789-c710-3b17-9460-16163591d93f","product":{"name":"incus-tools-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"0437571b-35b8-3eec-b808-726d5ffcde2a","product":{"name":"incus-cli-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"055e79ea-486e-3c05-98f8-35197166b6cd","product":{"name":"incus-cli-zsh-completion-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"06b12a41-b007-3090-86c7-5aa3eec20eb8","product":{"name":"incus-tools-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"29c90d22-e153-3fc3-95b8-6edc33a33b76","product":{"name":"incus-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"31c4580e-6ad3-39d6-b665-224d84287177","product":{"name":"incus-cli-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"4b7a8928-b8aa-3773-855c-6880bbaab457","product":{"name":"incus-cli-fish-completion-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"667eafc2-5107-3083-a29c-2ea312423cf1","product":{"name":"incus-cli-bash-completion-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"71c4e5a6-7c79-3f6a-a670-efce312e7775","product":{"name":"incus-cli-zsh-completion-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"778ffed4-fd86-3888-b1e8-a91cd0e5294d","product":{"name":"incus-cli-bash-completion-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7b39a356-718a-37e2-aac4-2cbf349d558a","product":{"name":"incus-cli-fish-completion-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"8b05d619-a1a8-367d-a706-17664db33693","product":{"name":"incus-cli-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"8ef511e4-900c-3ea5-ae04-0fe047a8f63a","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"913203f9-c901-3c34-96f8-6db1c564151b","product":{"name":"incus-0:7.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"91c03075-af87-36f2-b8e9-7d5f1533aacb","product":{"name":"incus-tools-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"ab6ccc6f-660c-3880-a05d-e3b68a5c840c","product":{"name":"incus-cli-bash-completion-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"b387857e-6a7f-352b-8810-2d1b348e32ff","product":{"name":"incus-cli-zsh-completion-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"b6aaa0fd-1fd8-3d86-9f40-80729614d3f1","product":{"name":"incus-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c302e38c-fd12-30d4-95da-5c80bb3bf690","product":{"name":"incus-tools-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"c489ed71-3ab8-3693-aaa1-93d441cc0989","product":{"name":"incus-cli-fish-completion-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"c54ff042-297e-3f89-b844-7b1cfc0ed49a","product":{"name":"incus-cli-bash-completion-0:7.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"cc244842-7b65-38ef-bd3a-d42275a18afb","product":{"name":"incus-cli-fish-completion-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"ce48a0e4-a973-3859-9948-b6b45721d92b","product":{"name":"incus-cli-0:7.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"d09dcf9a-9015-3724-8cda-13a869b8c222","product":{"name":"incus-cli-zsh-completion-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"de406327-2ca1-3139-8d56-ce19454d34a0","product":{"name":"incus-0:7.4-1.1.x86_64","vendor":{"name":"SUSE"}}}]}}]}