Incus, a system container and virtual machine manager, contains a path traversal flaw in its S3 multipart upload endpoint. An attacker can supply a specially crafted upload path that resolves outside the intended container storage, creating arbitrary files on the host filesystem. This allows the insertion of executable payloads or critical configuration changes, potentially leading to arbitrary command execution. The weakness is a classic write-to-path traversal flaw (CWE‑22) and also involves file creation from user‑controlled paths (CWE‑73).

Vendors and products: Incus (lxc:incus). The vulnerability applies to all releases prior to version 7.1.0. Version 7.1.0 and later contain the fix. No specific build numbers are listed beyond the major version.

The CVSS score of 9.9 indicates critical severity. EPSS is < 1%, so exact exploit probability cannot be quantified. The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can likely exploit this remotely by sending a malicious multipart upload request to the S3 endpoint; no authentication requirements are mentioned, implying the endpoint is accessible to any network participant that can reach the service. The resulting arbitrary file write gives attackers the ability to place executable payloads or modify critical configuration files, enabling arbitrary command execution. Given its high severity and the fact that the flaw exists in older installations, it poses a serious threat to affected systems.