{"id":"CVE-2026-115375","kind":"vulnerability","aliases":["CVE-2026-115375"],"related":[],"title":"Incus: crafted instance backup writes files outside storage, full host takeover","description":"Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise.","summary":"Incus does not validate dependent custom volume names in an instance backup's index.yaml. A client allowed to create instances can import a crafted backup with ../ in those names and make the root daemon create directories and unpack attacker-controlled content anywhere on the host, which means full host compromise. It can also create volumes in projects the caller cannot access. Part of the Incus 7.5 release, which fixed 11 security issues.","severity":"critical","cvss":9.9,"epss":0.00405,"exploited":false,"exploited_at":null,"products":[{"name":"incus","fixed":["7.0.2","7.5.0"],"affected":">= 7.0.0, < 7.0.2; >= 7.1.0, < 7.5.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["containers","incus","infrastructure","linux","self-hosted"],"not_affected_if":["incus-below-7.0.0","no-untrusted-instance-creators"],"how_to_check":"Run 'incus --version' (or 'incusd --version') on each host. Versions 7.0.0 to 7.0.1 and 7.1.0 to 7.4.x are affected. Also list who can create instances ('incus project list' and your OpenFGA or TLS client permissions), because only clients with that permission can exploit this. Versions below 7.0.0 are unconfirmed.","fix":"Upgrade to Incus 7.0.2 or later on the 7.0 LTS line, or 7.5.0 or later otherwise. A third-party write-up says 7.5.0 had artifact problems and recommends 7.5.1. Workaround from upstream: only let trusted clients create instances.","status":"open","published_at":"2026-10-22T19:17:44+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:10+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:32:10Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Incus to 7.0.2 or later on the 7.0 line, or 7.5.0 or later on the 7.1 line.","reach":"local","title":"Incus: crafted instance backup writes files outside storage, full host takeover","impact":"high","summary":"Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 accept dependent custom volume names containing ../ in instance backup index.yaml files. A client that can create instances can import a crafted backup and write root-owned files anywhere on the host, which leads to full host compromise.","category":"infrastructure","who_cares":["incus","self-hosted","linux"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker writes root-owned files on the host and takes it over","analyst_note":"Confirm the exact fixed versions and whether any Incus version below 7.0.0 is affected, using the NVD entry and the upstream Incus security advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["incus-below-7.0.0","no-untrusted-instance-creators"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.00051,"input_tokens":2990,"output_tokens":423,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the exact fixed versions and whether any Incus version below 7.0.0 is affected, using the NVD entry and the upstream Incus security advisory.","search":"'-115375':14A,17A '-2026':13A,16A '11':96B '7.0.0':100C '7.0.2':102C '7.1.0':104C '7.5':92B '7.5.0':106C 'abl':115C 'access':87B 'allow':42B,113C 'also':79B 'anywher':68B 'attack':65B,139C 'attacker-control':64B 'backup':4A,37B,50B,136C,145C 'caller':85B 'cannot':86B 'client':41B,114C 'compromis':76B,165C 'contain':19B,107C 'content':67B,160C 'control':66B,159C 'craft':2A,49B,143C 'creat':44B,60B,80B,117C,153C 'custom':31B,131C 'cve':12A,15A 'daemon':59B 'depend':30B,130C,149C 'directori':61B,157C 'file':6A,121C,138C 'fix':95B 'flaw':126C 'full':9A,74B,163C 'host':10A,25B,71B,75B,124C,164C 'import':47B,141C 'incus':1A,18A,20B,26B,91B,99C 'index.yaml':39B,137C 'infrastructur':21B 'instanc':3A,36B,45B,118C,135C,144C 'issu':98B 'lead':161C 'linux':22B 'make':56B 'mean':73B 'name':33B,54B,133C,151C 'outsid':7A 'own':156C 'part':88B 'path':109C 'project':83B 'releas':93B 'root':58B,155C 'root-own':154C 'secur':97B 'self':24B 'self-host':23B 'sequenc':147C 'stem':127C 'storag':8A 'takeov':11A 'travers':110C 'unpack':63B 'unvalid':129C 'valid':29B 'volum':32B,81B,132C,150C 'vulner':111C 'write':5A,120C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115375","severity":null,"published_at":"2026-10-22T19:17:44+00:00","modified_at":"2026-10-23T17:06:36+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115375:300","url":null,"severity":null,"published_at":"2026-10-23T22:47:31+00:00","modified_at":"2026-10-23T22:47:31+00:00","first_seen_at":"2026-10-23T22:47:31+00:00","fetched_at":"2026-10-23T22:47:31+00:00","note":"Read upstream GHSA-hpjh-q53p-f27r (stgraber, Sep 25 2026, 9.9 CVSS3.1) and VulnCheck/NVD-style range. Upstream says <7.5.0 fixed in 7.5.0; VulnCheck narrows to 7.0.0-<7.0.2 and 7.1.0-<7.5.0 (7.0.2 not named in the GHSA, taken from VulnCheck). Versions below 7.0.0 (6.x): not stated by any source, unknown; GHSA package is the v7 module. No exploitation or PoC found; no X search done."},{"source":"epss","external_id":"CVE-2026-115375","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115375","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1603,"url":"https://github.com/lxc/incus/security/advisories/GHSA-hpjh-q53p-f27r","title":"GHSA-hpjh-q53p-f27r: Arbitrary file write on host via path traversal in instance backup dependent volumes","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1604,"url":"https://www.vulncheck.com/advisories/incus-7.0.0-before-7.0.2-and-7.1.0-before-7.5.0-path-traversal-via-instance-backup-dependent-volumes","title":"VulnCheck: Incus path traversal via instance backup dependent volumes","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1605,"url":"https://severitydaily.com/incus-lts-host-escape-fixes-unannounced-vulncheck-cve/","title":"Severity Daily: Incus shipped LTS fixes with no security note","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}