CVE-2026-115378
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull
CVSS Score
5.8
EPSS Score
0.0%
EPSS Percentile
0th
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host.
| CWE | CWE-59 |
| Vendor | lxc |
| Product | incus |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for lxc incus
Be the first to know when new medium vulnerabilities affecting lxc incus are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
lxc / incus
0 < 6.0.7 6.1.0 < 7.0.2 7.1.0 < 7.5.0
References
Credits
stgraber 🔍 palkeo