[ CVE-2026-115378 · Published 22 Oct 2026 ]
Vulnerability in lxc incus
CVSS 5.8
No fix listed yet
[ Description ]Official description
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.