CVE-2026-115377 in Incus
Summary
by MITRE • 10/22/2026
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability represents a critical security flaw within Incus container and virtual machine management software, specifically affecting versions prior to 6.0.7, 6.1.0 through 7.0.2, and 7.1.0 through 7.5.0. This issue is classified as an arbitrary file write vulnerability that stems from insufficient validation of symbolic links during the volume migration process. The core technical flaw lies in how Incus handles incoming data streams generated by rsync or btrfs receive operations when migrating storage volumes between hosts. During these migrations, the software fails to adequately sanitize or restrict symlink targets within the transferred filesystem structures. This oversight allows a malicious actor controlling the source of the migration to inject specially crafted symbolic links that point outside the intended volume directory and into sensitive areas of the host operating system's file hierarchy.
The operational impact of this vulnerability is severe, as it enables privilege escalation from a container or virtual machine context to full root-level compromise on the underlying host infrastructure. An attacker can exploit this flaw by constructing an rsync stream or btrfs receive payload that contains a symlink named rootfs pointing directly to the host's root directory /. When Incus processes this migration request without proper validation, it follows the symbolic link and writes files into the specified location with the privileges of the Incus daemon process. Since these daemons typically run as the root user, any file written through this mechanism inherits those elevated permissions. This effectively bypasses container isolation boundaries, allowing the attacker to modify critical system binaries, install backdoors, alter configuration files, or exfiltrate sensitive data from the host machine itself.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-59 Improper Link Resolution Before File Access and CWE-73 External Control of Symbolic Link Path. It also maps to MITRE ATT&CK techniques related to privilege escalation and persistence, specifically leveraging file system manipulation for lateral movement or host compromise. The attack vector is primarily remote if the Incus API is exposed to untrusted networks, though it can also be exploited locally by users with permission to initiate volume migrations. The severity is heightened because successful exploitation does not require complex exploit chains; a single crafted migration request is sufficient to achieve arbitrary file write capabilities as root.
Mitigation strategies must prioritize immediate software updates and strict access controls. Administrators should upgrade Incus to version 6.0.7, 7.0.2, or 7.5.0 and later, where these validation checks have been implemented to prevent symlinks from resolving outside the designated volume directories during migration operations. In environments where upgrading is not immediately feasible, network segmentation policies should be enforced to restrict who can initiate volume migrations between hosts. Additionally, implementing least-privilege principles for Incus daemon processes and monitoring file system integrity changes on host systems can help detect or prevent exploitation attempts. Regular auditing of migration logs and strict validation of source trustworthiness are essential defensive measures against this type of supply chain-style attack vector involving malicious migration sources.