crítica
CVE-2026-48753
incus: Incus has an arbitrary file write via path traversal in S3 multipart upload
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
GHSA10.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según GHSA, Red Hat.
Descripción
Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/lxc/incus/v7/cmd/incusd | 7.1.0 |
| alpine 3.24 | incus | 7.0.1-r0 |
| alpine edge | incus, incus-feature | 7.0.1-r0 y 1 más |
| debian 14 | incus | 7.0.0-2 |
| rapidfort alpine 3.20 | incus, incus-feature | 7.0.1-r0 y 1 más |
| rapidfort alpine 3.21 | incus, incus-feature | 7.0.1-r0 y 1 más |
| rapidfort alpine 3.22 | incus, incus-feature | 7.0.1-r0 y 1 más |
| rapidfort alpine 3.23 | incus, incus-feature | 7.0.1-r0 y 1 más |
| rapidfort alpine 3.24 | incus, incus-feature | 7.0.1-r0 y 1 más |
| rapidfort debian 12 | incus | 0:7.0.0-2 |
| rapidfort debian 13 | incus | 0:7.0.0-2 |
| rapidfort fedora 43 | incus, incus-agent, incus-client y 2 más | 6.23-4.fc43 |
Mostrar las 25 entradas de 15 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/lxc/incus/v7/cmd/incusd | 7.1.0 |
| alpine 3.24 | incus | 7.0.1-r0 |
| alpine edge | incus | 7.0.1-r0 |
| alpine edge | incus-feature | 7.2.0-r0 |
| debian 14 | incus | 7.0.0-2 |
| rapidfort alpine 3.20 | incus | 7.0.1-r0 |
| rapidfort alpine 3.20 | incus-feature | 7.2.0-r0 |
| rapidfort alpine 3.21 | incus | 7.0.1-r0 |
| rapidfort alpine 3.21 | incus-feature | 7.2.0-r0 |
| rapidfort alpine 3.22 | incus | 7.0.1-r0 |
| rapidfort alpine 3.22 | incus-feature | 7.2.0-r0 |
| rapidfort alpine 3.23 | incus | 7.0.1-r0 |
| rapidfort alpine 3.23 | incus-feature | 7.2.0-r0 |
| rapidfort alpine 3.24 | incus | 7.0.1-r0 |
| rapidfort alpine 3.24 | incus-feature | 7.2.0-r0 |
| rapidfort debian 12 | incus | 0:7.0.0-2 |
| rapidfort debian 13 | incus | 0:7.0.0-2 |
| rapidfort fedora 43 | incus | 6.23-4.fc43 |
| rapidfort fedora 43 | incus-agent | 6.23-4.fc43 |
| rapidfort fedora 43 | incus-client | 6.23-4.fc43 |
| rapidfort fedora 43 | incus-selinux | 6.23-4.fc43 |
| rapidfort fedora 43 | incus-tools | 6.23-4.fc43 |
| rapidfort ubuntu 20.04 | incus | 0:7.0.0-2 |
| rapidfort ubuntu 22.04 | incus | 0:7.0.0-2 |
| rapidfort ubuntu 24.04 | incus | 0:7.0.0-2 |