CVE-2026-115377

EUVD-2026-108300
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 33.66%
Debian logo
Debian Releases
Debian Product
Codename
incus
forky
7.0.1-5
fixed
sid
7.0.2-2
fixed
trixie
vulnerable
trixie (security)
6.0.4-2+deb13u11
fixed
Common Weakness Enumeration
References
https://github.com/lxc/incus/security/advisories/GHSA-579w-c4rw-c8q3
https://www.vulncheck.com/advisories/incus-before-6.0.7-6.1.0-before-7.0.2-and-7.1.0-before-7.5.0-arbitrary-file-write-via-symlink-in-migration-stream