Vulnerability GHSA-ccjc-4qc3-jxqc
Advisory details are being prepared in the background.
Critical
CRITICAL RISK
CVSS Score: 9.9
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
4 months ago
June 26, 2026 at 06:47 PM UTC
Incus has an arbitrary file write via path traversal in S3 multipart upload
<7.1.0
<7.1.0
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
2 months ago
Incus has a project restriction bypass in instance copy across projects
<7.2.0 GHSA-c9f5-j9c3-mhrg
<7.2.0 GHSA-c9f5-j9c3-mhrg
Critical
4 months ago
Incus has an arbitrary file write on its client due to trusted image hash
<7.2.0 GHSA-f6m5-xw2g-xc4x
<7.2.0 GHSA-f6m5-xw2g-xc4x
Low Risk
4 months ago
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)
<7.1.0 GHSA-xhqx-mgh3-3h7q
<7.1.0 GHSA-xhqx-mgh3-3h7q
Critical
4 months ago
Incus has an argument injection in backup compression algorithm leading to AFW and ACE
<7.2.0 GHSA-v6mj-8pf4-hhw4
<7.2.0 GHSA-v6mj-8pf4-hhw4
Low Risk
4 months ago
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
<7.1.0 GHSA-4xg6-52mh-fpw8
<7.1.0 GHSA-4xg6-52mh-fpw8
Impacted packages
Timeline
Published
4 months ago
June 26, 2026 at 06:47 PM UTC
Last Modified
4 months ago
July 07, 2026 at 08:41 PM UTC