Skip to content
CVE PROGRAM SOURCE RECORD9.4 Critical

CVE-2026-115375

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

lxc incus

Default version status: unaffected

  • 7.0.0 to < 7.0.2affected
  • 7.0.2unaffected
  • 7.1.0 to < 7.5.0affected
  • 7.5.0unaffected
pkg:golang/github.com/lxc/incus/v7/cmd/incusd

References