Skip to content
Critical Path Traversal Vulnerability in Canonical LXD and Incus

Critical Path Traversal Vulnerability in Canonical LXD and Incus

First seen 8 Nov 2026, 18:49 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 8, 2026 at 18:50 UTC
  • •CVE-2026-48769 allows arbitrary file writes and remote code execution as root.
  • •Affected systems include Canonical LXD and Linux Containers Incus versions below 6.9.0.
  • •Public proof-of-concept exploit code is available, heightening the risk of exploitation.

A critical path traversal vulnerability (CVE-2026-48769) has been identified in Canonical LXD and Linux Containers Incus, allowing authenticated users to exploit improper input validation. This flaw enables attackers to write arbitrary files on the host filesystem as root, leading to remote code execution. The vulnerability arises from the handling of the Incus-Image-Hash HTTP header during image imports, where the header is not adequately validated before being used in file paths. Affected versions include Incus 4.0.0 to 6.0.0 and Canonical LXD versions below 6.9.0. A public proof-of-concept exploit is available, increasing the urgency for patching. Users are advised to upgrade to the patched versions and restrict access to the APIs. The CVSS score for this vulnerability is 9.9, indicating a critical severity level. CISA has not listed this vulnerability in its KEV catalog.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 3d ago How this analysis works

Timeline

2026-08-21
CVE-2026-48769 published
Canonical disclosed a critical path traversal vulnerability affecting Incus and LXD, with a CVSS score of 9.9.
Dev.To
2026-11-08
Public PoC available
A public proof-of-concept exploit demonstrating the vulnerability has been released, increasing the urgency for mitigation.
Dev.To

More articles in this cluster (6)

Following this threat?

Track Canonical and CVE-2026-48769 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

Which versions are affected?
Incus versions 4.0.0 to 6.0.0 and Canonical LXD versions below 6.9.0 are affected.
Is there a patch available?
Yes, users should upgrade to Incus version 7.2.0 or later and Canonical LXD version 6.9.0 or later.
What are the recommended mitigation strategies?
Restrict access to the APIs, enforce strict firewall policies, and monitor critical directories for unauthorized changes.