Incus's built‑in S3 server verifies signatures incorrectly, allowing a holder of a presigned upload URL to inject unsigned x-amz‑* headers. An attacker can include an unsigned X-Amz-Copy-Source header, which causes the server to copy the target object onto the provided key. The content of the source object and its ETag are therefore returned, exposing sensitive data and potentially revealing the presence of other objects. This flaw is defined as CWE‑347, an incorrect constraint implementation that compromises confidentiality.

Vulnerable releases are Incus 7.0.0 up to 7.0.1 and Incus 7.1.0 up to 7.4.9. The affected product is LinuxContainers Incus, version 7.0.0‑before‑7.0.2 and 7.1.0‑before‑7.5.0. No other vendors or major product lines are listed.

The CVSS score of 7.1 indicates a high impact; the EPSS score is not available and the vulnerability is not present in CISA's KEV catalogue. The exploitation vector is remote, via presigned S3 URLs, and requires only possession of a valid URL. Once the URL is in hand, an attacker can use the service to retrieve any object available to the presigned URL policy, making the vulnerability potentially exploitable in open or misconfigured environments.