Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Incus allows attackers to write any host file via migration

CVE-2026-115377 · published 1 day ago
Summary

Incus versions before 6.0.7, 6.1.0, and 7.1.0 let a malicious migration source place symbolic links that cause files to be written to the host system. This can let an attacker add or change files as the root user, potentially taking full control of the server. Upgrade Incus to the patched releases (6.0.7, 7.0.2, or 7.5.0 and later) and ensure only trusted sources are used for migrations.

What to do
  • Update debian incus to version 6.0.4-2+deb13u11.
  • Update debian incus to version 7.0.1-5.
  • Update lxc incus to version 6.0.7 or later.
Affected software
Ecosystem VendorProductAffected versions
– lxc incus < 6.0.7
Debian:13 debian incus < 6.0.4-2+deb13u11
Fix: upgrade to 6.0.4-2+deb13u11
Debian:14 debian incus < 7.0.1-5
Fix: upgrade to 7.0.1-5
Original advisory text
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.4 Critical
Type
CWE-59Link Following
Timeline
Published22 Oct 2026
Updated23 Oct 2026
First seen22 Oct 2026
Sources
CVE-2026-115377 · NVD
CVE-2026-115377 · MITRE
DEBIAN-CVE-2026-115377 · OSV
CVE-2026-115377 · OSV
GHSA-579w-c4rw-c8q3 · GHSA
Track software like this
Free during beta