CVE-2026-115375

Summary

A path traversal flaw in Incus instance backup handling allows authenticated users to escape container boundaries by embedding ../ sequences in dependent volume names within crafted index.yaml files, enabling arbitrary file creation on the host as root.

Exploitability

Requires low-privilege access to create instances and upload backups; no user interaction or complex conditions needed.

Blast radius

Successful exploitation grants full host compromise, including root access and persistence via system file modification.

Detection

Monitor for creation of unexpected root-owned directories or files outside standard instance storage paths (e.g., /var/lib/incus/volumes/*/../) in host filesystem logs; also watch for backup import events containing nested directory structures with '..' components in volume names.

Prioritized remediation

Upgrade to Incus 7.0.2 or 7.5.0 or later, as these versions patch the unvalidated dependent custom volume name handling.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.