Go/github.com/lxc/incus/v7/cmd/incusd CVE-2026-48753: critical 9.9, EPSS 0.73%

Incus has an arbitrary file write via path traversal in S3 multipart upload

Action: Upgrade github.com/lxc/incus/v7/cmd/incusd to 7.1.0 or later.

go get github.com/lxc/incus/v7/cmd/incusd@v7.1.0

Affected

Fixed versions

Sources

• osv: GHSA-ccjc-4qc3-jxqc
• https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc
• https://github.com/lxc/incus

CVE-2026-48753 · published 2026-06-26T18:47:25Z · modified 2026-07-07T20:41:16.704887185Z · JSON