Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-115378

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

lxc incus

Default version status: unaffected

  • 0 to < 6.0.7affected
  • 6.0.7unaffected
  • 6.1.0 to < 7.0.2affected
  • 7.0.2unaffected
  • 7.1.0 to < 7.5.0affected
  • 7.5.0unaffected
pkg:golang/github.com/lxc/incus/v7/cmd/incus

References