The CVSS 9.9 rating is defensible, but it measures consequence, not mechanism. What's analytically distinct here is that Incus presented itself as providing workload isolation while exposing an S3 endpoint that workloads would legitimately use — and that endpoint mapped object storage semantics directly onto host filesystem paths. That's not just a path traversal bug; it's a trust model inversion where the storage mechanism users would reasonably trust becomes the attack vector against the isolation boundary it should enforce.
Two questions determine your actual exposure. First: what does the attacker overwrite to achieve command execution? If Incus creates or manages startup files on the host — cron directories, systemd unit paths, init scripts — then any container with S3 access has a reliable RCE path regardless of host configuration. That's opportunistic exploitation with broad blast radius. If the attacker must know the specific host's init structure, this becomes a precision attack requiring reconnaissance on targeted deployments. The disclosure doesn't specify which applies, and that gap matters enormously for prioritization.
Second: is the S3 endpoint reachable from within isolated workloads, or does exploitation require host-level or network adjacency? If container-local, this is a container-to-host escape requiring only low-privilege container code execution — every workload using the endpoint is already positioned to attack. If the endpoint requires host-adjacent access, the attack surface shrinks to infrastructure targeting, which is a fundamentally different threat model.
For the fix, look past the CVEs to the architecture. A path sanitization function or "../" blocklist is a one-time patch that won't survive the next S3 API extension. The meaningful fix isolates the S3 endpoint into a sandboxed storage context with no privileged host access, or redesigns the object-to-path mapping entirely. If 7.1.0 contains only string-matching logic without behavioral regression tests, the systemic debt remains — and the next S3-compatible feature in any container runtime will express the same vulnerability class, as the genealogical record from FTP to WebDAV to SMB consistently shows.
Prioritize: confirm whether Incus creates host startup files, determine endpoint exposure, and audit whether the patch addresses the design decision rather than just the symptom.