CVE-2026-115377: critical vulnerability in lxc incus
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.4epss 0.4%
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
lxc · incusRelated CVEs — lxc incus
In the same product, most dangerous first.
CVE-2026-23954HIGHIncus container image templating arbitrary host file read and writeEPSS 0.8%CVE-2026-48769CRITICALIncus has an arbitrary file write on its client due to trusted image hashEPSS 0.7%CVE-2026-48755CRITICALIncus has an argument injection in backup compression algorithm leading to AFW and ACEEPSS 0.7%CVE-2026-48753CRITICALIncus has an arbitrary file write via path traversal in S3 multipart uploadEPSS 0.7%CVE-2026-48752CRITICALIncus has arbitrary file read+write on host via templates/ symlink in malicious imageEPSS 0.7%CVE-2026-48750CRITICALIncus has an arbitrary file write on host via `exec-output` symlink in crafted imageEPSS 0.7%