A critical path traversal vulnerability in the LXC Incus S3 upload endpoint allows authenticated users to write arbitrary files to the host, facilitating potential command execution.

This vulnerability is caused by improper validation of file paths during S3 protocol uploads (CWE-73). An authenticated attacker can exploit this to write files outside of the intended directory, which can be leveraged to execute arbitrary code on the host system.

Successful exploitation allows an attacker to gain persistent access to the host server by placing malicious files in sensitive locations. This compromises the integrity of the host and provides a pathway for further escalation or data theft. The CVSS score of 9.9 highlights the critical risk posed by this unauthorized write access.

Immediate Action: Update the LXC Incus software to version 7.1.0 or later to apply the necessary path validation fixes for the S3 upload endpoint.

Proactive Monitoring: Audit S3 upload logs for suspicious path characters or unexpected file creation events on the host.

Compensating Controls: If the S3 upload functionality is not required, disable the endpoint entirely to eliminate the attack surface until the patch can be applied.

Public Exploit Available: No

Organizations utilizing the S3 upload feature in Incus must prioritize upgrading to version 7.1.0 immediately. The ease with which this path traversal can be exploited makes it a high-priority target for attackers seeking host-level persistence.