Fluid Attacks Database

Description

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	incus	=6.0.4-2 \|\| =6.0.4-3 \|\| =6.0.5-1 \|\| =6.0.5-2 \|\| =6.0.5-3 \|\| =6.0.5-4 \|\| =6.0.5-5 \|\| =6.0.5-6 \|\| =6.0.5-7 \|\| =6.0.5-8 \|\| =6.0.6-1 \|\| =6.0.6-2 \|\| =6.0.6-3 \|\| =6.14.0-1~exp1 \|\| =6.15.0-1~exp1 \|\| =6.16.0-1~exp1 \|\| =6.17.0-1~exp1 \|\| =6.20.0-1~exp1 \|\| =6.21.0-1~exp1 \|\| =6.22.0-1~exp1 \|\| =6.23.0-1~exp1 \|\| =7.0.0-1 \|\| =7.0.0-1~bpo13+1 \|\| =7.0.0-2~bpo13+1 \|\| >=0 <7.0.0-2	7.0.0-2
go	github.com/lxc/incus/v7/cmd/incusd	>=0 <7.1.0	7.1.0
go	github.com/lxc/incus	-	-
go	github.com/lxc/incus/v6	-	-
go	github.com/lxc/incus/v7	>=0 <7.1.0	7.1.0
alpine v3.24	incus	>=0 <7.0.1-r0	7.0.1-r0

Aliases

1. CVE-2026-487532. NVD-2026-487533. OSV-DEBIAN-2026-487534. OSV-2026-487535. OSV-GO-2026-58026. OSV-ALPINE-2026-487537. GHSA-ccjc-4qc3-jxqc8. GCVE-2026-487539. SECURITY-TRACKER-CVE-2026-4875310. GHSA-ccjc-4qc3-jxqc11. SECURITY-CVE-2026-48753

References

1. https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.