Incus, a system container and virtual machine manager, contains a path traversal flaw in its S3 multipart upload endpoint. An attacker can supply a specially crafted upload path that resolves outside the intended container storage. This allows the creation of arbitrary files on the host filesystem, which in turn could be used for arbitrary command execution. The weakness is a classic write-to-path traversal flaw (CWE‑73).

Vendors and products: Incus (lxc:incus). The vulnerability applies to all releases prior to version 7.1.0. Version 7.1.0 and later contain the fix. No specific build numbers are listed beyond the major version.

The CVSS score of 9.9 indicates critical severity. EPSS is not available, so exact exploit probability cannot be quantified. The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can likely exploit this remotely by sending a malicious multipart upload request to the S3 endpoint; no authentication requirements are mentioned, implying the endpoint is accessible to any network participant that can reach the service. The resulting arbitrary file write gives attackers the ability to place executable payloads or modify critical configuration files, enabling arbitrary command execution. Given its high severity and the fact that the flaw exists in older installations, it poses a serious threat to affected systems.