{"id":"EUVD-2026-63980","revision":"d8682f76900a461f815126178c729612","records":[{"revision":"d8682f76900a461f815126178c729612","observedAt":"2026-11-07T11:30:30.671+00:00","statement":{"source":"euvd","id":"EUVD-2026-63980","aliases":["CVE-2026-48753","GHSA-ccjc-4qc3-jxqc"],"title":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary comma…","description":"Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9,"severity":null}],"references":["https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63980","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 21, 2026, 2:34:39 PM","dateUpdated":"Aug 21, 2026, 3:36:43 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2026:11651-1","title":"incus-7.4-1.1 on GA media","vulnerabilityIds":["CVE-2026-39402","CVE-2026-47753","CVE-2026-48749","CVE-2026-48750","CVE-2026-48751","CVE-2026-48752","CVE-2026-48753","CVE-2026-48754","CVE-2026-48755","CVE-2026-48756","CVE-2026-48769","CVE-2026-55621","CVE-2026-55622","CVE-2026-62313","CVE-2026-62867","CVE-2026-62940","CVE-2026-62941","CVE-2026-63125","CVE-2026-63343","CVE-2026-81500","CVE-2026-81501"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-63980","identifiers":["EUVD-2026-63980","CVE-2026-48753","GHSA-ccjc-4qc3-jxqc"]},"retained":false,"historicalAffected":[]}],"coverage":[]}