Attack Chain

1. Attacker identifies a vulnerable Incus instance (version < 7.1.0) with an exposed S3 API, typically via incus config set core.storage_buckets_address.
2. The attacker crafts a multipart S3 PUT request, targeting an S3 bucket configured on the vulnerable Incus instance.
3. The uploadId query parameter within the PUT request is maliciously manipulated, containing path traversal sequences such as ../../../../etc/cron.d.
4. The request body is populated with the content of a malicious cron job entry, for example, * * * * * root /bin/sh -c 'id > /incus-s3-uploadid-bash-rce; rm -f /etc/cron.d/part-00001'.
5. Due to the vulnerability in internal/server/storage/s3/local/multipart.go, Incus concatenates the unsanitized uploadId directly into the target file path during the upload process.
6. This results in an arbitrary file write on the host system, placing the malicious cron job content into a file like /etc/cron.d/part-00001.
7. The system's cron daemon periodically executes entries found in /etc/cron.d, triggering the newly created malicious job, leading to arbitrary command execution (e.g., id > /incus-s3-uploadid-bash-rce).
8. The executed cron job also includes a command to delete itself (rm -f /etc/cron.d/part-00001), providing persistent remote code execution while attempting to remove forensic evidence.

Impact

The primary impact of CVE-2026-48753 is the ability for an unauthenticated attacker to achieve arbitrary file write on the host system where Incus is running. This directly enables arbitrary command execution, as demonstrated by the ability to install persistent cron jobs. Successful exploitation can lead to a complete compromise of the Incus host, allowing attackers to establish persistence, exfiltrate data, disrupt services, or pivot to other systems within the network. This vulnerability is critical due to its unauthenticated nature and the severe consequences of command execution.

Recommendation

• Patch CVE-2026-48753 immediately by upgrading your Incus installation to version 7.1.0 or later as advised by the advisory.
• Deploy the Sigma rule in this brief to your SIEM/EDR to detect exploitation attempts of CVE-2026-48753 by monitoring for suspicious S3 PUT requests.
• Monitor web server access logs for HTTP PUT requests to S3 endpoints that contain path traversal sequences (../../ or ..%2F..%2F) in the uploadId query parameter.
• Enable comprehensive file integrity monitoring for critical system directories like /etc/cron.d, /tmp, and other common locations for malicious file drops.