Threat Intelligence Report — CVE-2026-48753

Executive Summary

CVE-2026-48753 is a critical path traversal vulnerability in the S3 protocol upload endpoint of Incus, a system container and virtual machine manager, affecting versions prior to 7.1.0. An attacker with low-privileged access to the S3 endpoint can write arbitrary files to the host operating system, which can be chained to achieve arbitrary command execution. With a CVSS score of 9.9, the vulnerability imposes a severe risk to the confidentiality, integrity, and availability of the host and all containers or VMs it manages; the fixed version is 7.1.0.

Technical Analysis

The foundation of this vulnerability is a path traversal flaw in the S3-compatible upload mechanism within Incus, classified under CWE-73 (External Control of File Name or Path). The NVD description explicitly states that the flaw is located in the "S3 protocol upload endpoint" and allows "creation of arbitrary files on the host." This indicates that the application, when handling object names during S3 PUT requests, inadequately sanitizes user-supplied filenames or key paths, thus enabling an attacker to inject traversal sequences (e.g., ../) and escape the designated storage directory.

The vulnerability class (CWE-73) suggests that the code constructs a filesystem path by concatenating user input without a robust validation layer. This could involve a flawed normalization routine, a missing check for parent directory components, or inadequate handling of absolute paths. In the specific context of Incus, the "host" is the underlying operating system running the Incus daemon. A successful write operation could target system directories, configuration files, startup scripts, or binaries.

The CVSS vector underscores the criticality of the flaw:

• Attack Vector: Network (N) — Exploitable over the network via the S3 API.
• Attack Complexity: Low (L) — No special conditions are required for a successful exploit.
• Privileges Required: Low (L) — An attacker only requires a valid, low-privileged account on the S3 endpoint, not administrative access to the host.
• User Interaction: None (N) — No user action is needed.
• Scope: Changed (S) — The impact extends beyond the vulnerable component (the S3 storage service) to the entire host operating system, affecting other containers, VMs, and the Incus daemon itself.

The specific implementation details of the vulnerable upload handler remain undisclosed in the public description, providing insufficient technical detail to map the exact functions or code paths involved. The focus of the vulnerability is the lack of proper input validation, which allows file creation outside the intended storage root. The lack of public exploit code or PoC at the time of this report indicates that the exploitation techniques are inferred from the vulnerability class and known S3 implementation patterns.

Exploitation Scenarios

Given the nature of the vulnerability, the following detailed attack chain is discernible, strictly adhering to the available information:

1. Reconnaissance/Target Identification: An attacker first identifies an internet-facing Incus instance with the S3 protocol endpoint enabled. This can be done via Shodan-style queries (e.g., searching for Incus-specific headers or API fingerprints). The attacker then attempts to authenticate to the S3 endpoint. The NVD description notes that only "Low" privileges are required, meaning the attacker might already have access to a limited user account or could exploit a misconfiguration (such as a publicly accessible bucket) to bypass authentication entirely.

2. Triggering the Specific Flaw: The attacker sends a PUT request to the S3 upload endpoint to store an object. The flaw is triggered by crafting the object name (the "key" in S3 terminology) to include path traversal sequences. Since the S3 endpoint is designed to handle object creation, the attacker supplies a key such as ../../../../etc/cron.d/backdoor. The server, failing to adequately sanitize the input, interprets this as a path relative to the storage root, effectively validating the path and preparing to write the file to the host's filesystem.

3. Payload/Execution Method (Vulnerability-Class Level): The attacker controls the content of the file being "uploaded." To achieve arbitrary command execution, the attacker must target a location and file type that will be interpreted as executable code or run automatically by the system. Common techniques at this vulnerability-class level include:

   • Writing a cron job into /etc/cron.d/ that executes a reverse shell or any command with host-level privileges.
   • Overwriting or creating a file in a directory that is automatically sourced by startup scripts (e.g., /etc/profile.d/, /etc/rc.local).
   • Placing a web shell into a web-root directory if the host runs a web server.
   • Replacing a system library or configuration file to achieve code execution upon subsequent service restarts.

4. Post-Exploitation Impact: A successful write of a malicious file to the host grants the attacker host-level code execution, typically in the context of the incus daemon or root, depending on the permissions of the service. This provides complete control over the host, enabling the attacker to move laterally across all managed containers and virtual machines, extract sensitive data (including all credentials and secrets stored on the host), and pivot deeper into the network. The "Changed" scope in the CVSS score reflects this cross-component impact. The attacker can establish persistence, install backdoors, and potentially compromise the entire infrastructure.

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description. The attack's success hinges on the attacker's ability to craft valid path traversal payloads and select a suitable writable target directory on the host.

Impact Assessment

The business impact of CVE-2026-48753 is catastrophic for any organization using Incus as its virtualization or containerization platform.

• Confidentiality Impact: High (H): An attacker can read any file on the host, including databases, secrets, API keys, and the contents of all containers and VMs.
• Integrity Impact: High (H): Arbitrary file creation and overwriting allows the attacker to modify system binaries, configuration, and data on the host, leading to complete loss of trust in system integrity.
• Availability Impact: High (H): The attacker can easily render the host or the hosted workloads unusable, either through destructive file writes (e.g., wiping critical system files) or by launching other attacks from the compromised position.
• Scope: Changed (S): The impact from this vulnerability crosses security boundaries, meaning the compromise of the S3 upload service directly impacts the host OS and all other components, every container, and every virtual machine managed by the Incus daemon.

Affected Systems: All Incus deployments using S3 protocol upload functionality and running versions prior to 7.1.0. This includes both cloud-native environments and on-premises virtualization platforms.

Blast Radius: The blast radius equates to the entire host and all of the workloads it runs. Given the low privileges required and network-based attack vector, even a single low-privileged user with access to the S3 API can perform a full host takeover, making it an extremely dangerous and easily accessible attack vector once an endpoint is found.

Detection Guidance

The following detection rules assume the attacker is actively exploiting the path traversal flaw. Network and host-level detections focus on anomaly detection due to the lack of public exploit payload details.

Sigma Rule

Detects suspicious PUT requests to an S3 endpoint with URL-encoded or raw path traversal sequences (e.g., ../) in the object key.

title: Incus S3 Upload Path Traversal Attempt
id: 6f3a5c11-2d67-4a8b-9b02-29f129a1a8c5
status: experimental
description: Detects potential path traversal attempts on Incus S3 upload endpoints via object key patterns.
logsource:
  category: webserver
  product: apache
  service: access_log
detection:
  selection:
    cs-method: 'PUT'
    cs-uri-query|contains:
      - '..%2f'
      - '..%5c'
      - '%2e%2e%2f'
      - '%2e%2e%5c'
      - '/../'
  condition: selection
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate usage of S3 bucket APIs with dynamic paths (very rare).
level: high

YARA Rule

This rule scans files or memory for potential web shells or cron jobs that might be created by the exploit.

rule incus_s3_path_traversal_payloads
{
    meta:
        description = "Detects potential malicious files dropped via Incus S3 path traversal"
        author = "Valtersit Security Research"
        date = "2026-10-26"
    strings:
        $s1 = "../" ascii
        $s2 = "..\\" ascii
        $s3 = "/etc/cron.d/" ascii
        $s4 = "/etc/profile.d/" ascii
        $s5 = "#!/bin/bash" ascii
        $s6 = "nc -e /bin/sh" ascii
        $s7 = "python3 -c" ascii
    condition:
        any of them
}

Suricata IDS Rule

Network-level detection for HTTP PUT requests containing path traversal sequences to the / or /s3/ path.

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Incus S3 Path Traversal Attempt"; flow:to_server, established; http.method; content:"PUT"; http.uri; content:"../"; http.uri; content:"/"; within:10; classtype:attempted-admin; sid:202648753; rev:1; metadata:created_at 2026_10_26, updated_at 2026_10_26, cve CVE-2026-48753;)

Elastic Detection

EQL query for monitoring file system activity for writes outside of the expected Incus storage directory.

file where event.action == "write" and process.name == "incusd" and
  // Monitoring for writes outside the typical data directory
  not file.path : "/var/lib/incus/*" and
  (
    file.path : "/etc/cron.d/*" or
    file.path : "/etc/profile.d/*" or
    file.path : "/tmp/*" or
    file.path : "/usr/local/bin/*"
  )

Splunk SPL Query

Splunk query to look for web access logs with PUT method and path traversal patterns in the URI.

index=web sourcetype=access_combined
| where method="PUT" (uri="*\.\./*" OR uri="*..%2f*" OR uri="*%2e%2e%2f*")
| stats count by clientip, uri, status, useragent
| sort -count

Wazuh OSSEC Rule

Wazuh rule to detect anomalous writes to system directories that might indicate exploitation.

<group name="syscheck,incus,">
  <rule id="887401" level="12">
    <if_sid>550</if_sid>
    <field name="file.path">^/etc/cron\.d/|^/etc/init\.d/|^/etc/rc\.d/</field>
    <description>Potential host takeover via Incus S3 path traversal (CVE-2026-48753): suspicious write to system directory.</description>
    <group>incus,cve-2026-48753,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Two independent sources (Debian and at least one other) confirm that version 7.1.0 fixes the issue.

Immediate Mitigations:

1. Disable S3 Endpoint: If the S3 protocol upload endpoint is not critical for operation, disable it immediately on all Incus instances.
2. Firewall Restrictions: Restrict network access to the S3 API endpoint (2380, 8443, or custom port) to only trusted internal networks and trusted users. Disallow access from untrusted or public networks.
3. Strict Access Control: Enforce Multi-Factor Authentication (MFA) and review all user accounts with access to the S3 endpoint. Remove any unused accounts.

Patch/Upgrade Steps:

1. Upgrade Incus: Immediately upgrade Incus to version 7.1.0 or the latest available stable version on all systems.
2. Verify Upgrade: After upgrading, verify the incus version to confirm the patch is applied.
3. Monitor Debian Repositories: For Debian-based systems, wait for and apply the official Debian Security Advisory or bugfix release containing the patched package.

Long-Term Hardening:

1. Least Privilege: Ensure the incusd daemon runs with the least privileges possible. Avoid running it as root if a rootless configuration is available. This limits the impact of arbitrary file writes.
2. Filesystem Monitoring: Implement File Integrity Monitoring (FIM) on the host (e.g., Wazuh, Auditd) to alert on unauthorized changes to system-critical paths and configuration files.
3. Input Validation: Review the S3 implementation after the patch to understand the root cause and ensure robust input validation is in place to prevent future path traversal issues.
4. Network Segmentation: Keep management interfaces (including the S3 API) on separate VLANs from production traffic.
5. Patch Management: Enforce a rigorous patch management schedule to ensure critical fixes are applied promptly.

References

1. NVD Entry for CVE-2026-48753: [NVD Link will be active at time of publication] — Primary source for CVSS score and vulnerability description.
2. Debian Security Tracker: [Debian Security Tracker link for package] — Confirmation of the fix in version 7.1.0.
3. Incus Official Releases: [Incus Release Notes] — Vendor-maintained description of changes introduced in version 7.1.0.
4. CWE-73 - External Control of File Name or Path: [MITRE CWE page] — Describes the vulnerability class, its variations, and common consequences.

Threat Actor Information: No active threat actor campaigns have been identified for this CVE. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation in the wild is currently unknown. However, due to the significant exposure of S3-based APIs and the ease of exploitation (low complexity, low privileges), threat actors are likely to develop exploits shortly after full technical details are disclosed.