CVE-2026-115375 in Incus
Summary
by MITRE • 10/22/2026
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified within Incus versions 7.0.0 through 7.0.2 and 7.1.0 through 7.5.0 represents a critical path traversal flaw that fundamentally undermines the isolation boundaries between container instances and the underlying host system. This security defect is rooted in the insufficient validation of dependent custom volume names found within instance backup index.yaml files. When an attacker possesses the ability to create or import instances, they can exploit this lack of sanitization by crafting a malicious backup archive containing directory traversal sequences such as ../ embedded within the metadata for dependent volumes. The Incus daemon processes these filenames without adequate checks to ensure they remain confined within the designated storage directories, thereby allowing the application to resolve paths that escape the intended container sandbox and write files directly onto the host filesystem.
From an operational perspective, this vulnerability enables a low-privilege attacker who has access to instance creation capabilities to achieve full compromise of the host operating system. By manipulating the volume names during the import process, the attacker can force the Incus service, which typically runs with elevated privileges to manage container resources, to create directories and write files at arbitrary locations on the host disk. The ability to create root-owned directories with controlled content is particularly dangerous as it facilitates privilege escalation and persistence mechanisms. Once the attacker has written malicious scripts or configuration files into sensitive system paths, they can execute code with root-level permissions, effectively gaining complete control over the infrastructure hosting the Incus instances. This scenario transforms a container escape vulnerability into a direct path to host takeover, negating the security benefits of virtualization and containerization.
This flaw aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as it involves accessing files or directories that are outside the restricted directory intended by the system's architecture. Furthermore, in terms of offensive cyber operations, this vulnerability maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter for executing malicious code after gaining initial access, and potentially T1486 Data Encrypted for Impact if used for ransomware deployment on the host. The exploitation chain relies heavily on social engineering or prior compromise of a user account with instance creation rights to deliver the crafted backup file, making it a significant risk in multi-tenant environments where trust boundaries are critical.
To mitigate this vulnerability, organizations must immediately upgrade Incus to version 7.0.2 or later for the 7.0 branch and version 7.5.0 or later for the 7.1 branch, as these releases include patches that enforce strict validation on volume names during backup import operations. Administrators should also review their access control policies to ensure that only trusted users have permission to create instances or import backups, thereby reducing the attack surface available to potential adversaries. Additionally, implementing file integrity monitoring and restricting write permissions for container service accounts can provide an additional layer of defense against path traversal attacks even if similar vulnerabilities are discovered in future updates. Regular auditing of instance configurations and backup contents is recommended to detect any anomalous behavior indicative of exploitation attempts.