CVE-2026-48753: Incus S3 Multipart Upload Path Traversal Enables Arbitrary File Write

Vulnerability Overview

CVE-2026-48753 is a critical path traversal vulnerability (CVSS 9.9, CWE-73: External Control of File Name or Path) in the Incus container and VM manager daemon (incusd). The root cause is insufficient sanitization of S3 multipart upload object keys — an attacker who can send crafted multipart upload requests can embed path traversal sequences (e.g. ../../) in the object key, causing the daemon to write attacker-controlled content to arbitrary locations on the host filesystem. The impact is severe: successful exploitation can lead to container escape, privilege escalation, or persistent backdoor installation on the underlying host.

Affected Software

The vulnerability affects Incus (github.com/lxc/incus/v7/cmd/incusd), the Go-based successor to LXD maintained under the Linux Containers project. All versions prior to 7.1.0 are affected. No patched release date has been confirmed at time of writing — operators should monitor the upstream repository for a fix and apply it immediately upon release.

Exploitation Status

A public proof-of-concept (PoC) has been disclosed as of 2026-06-26. This is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but the availability of a public PoC dramatically lowers the barrier to exploitation. Any Incus installation exposing its S3-compatible API to untrusted networks or multi-tenant workloads should be treated as at immediate risk. The combination of a CVSS 9.9 score and public PoC warrants emergency triage.

Detection Coverage

Our detection ships SIEM coverage across seven platforms, giving defenders broad visibility regardless of their logging stack:

• Microsoft Sentinel (KQL) — queries process and file event telemetry for anomalous write paths initiated by the incusd process, flagging traversal patterns in object key strings.
• Splunk (SPL) — correlates incusd API request logs with filesystem write events outside expected storage roots.
• Elastic (EQL) — sequence-based detection linking an S3 multipart upload request to a subsequent file creation event in sensitive directories.
• QRadar (AQL) — event rules targeting abnormal file write activity from the Incus daemon process.
• Sumo Logic — log search rules keying on traversal sequences in recorded S3 object key fields.
• Chronicle (YARAL) — UDM-mapped rules correlating network request metadata with host file write events attributed to incusd.
• CrowdStrike (CQL) — endpoint telemetry rules detecting file writes by incusd to paths inconsistent with normal Incus storage layout.

At a high level, all queries share the same detection hypothesis: the Incus daemon should never write files outside its configured storage pool directories. Any file write by incusd to paths such as /etc/, /root/, SSH authorized_keys locations, or cron directories is a strong indicator of exploitation.

Recommended Actions

• Upgrade to Incus 7.1.0 or later as soon as a patch is available.
• Until patched, restrict network access to the Incus API to trusted management hosts only.
• Review incusd file write activity on all hosts for evidence of prior exploitation.
• Enable the detections below and set alert severity to critical given the public PoC status.

Full KQL, SPL, Elastic EQL, QRadar AQL, Sumo Logic, Chronicle YARAL, and CrowdStrike CQL detection queries — along with playbook guidance and atomic test cases — are available on the CVE-2026-48753 detection page.