medium5.8
CVE-2026-115378
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious …
Impact
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host.
Affected products
| Product | Affected versions |
|---|---|
| Incus | before 6.0.7 |
| 6.1.0 | before 7.0.2 |
| And 7.1.0 | before 7.5.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.