CVE-2026-115375

Name of the Vulnerable Software and Affected Versions Incus versions 7.0.0 through 7.0.1 Incus versions 7.1.0 through 7.4.9

Description A path traversal issue exists where clients with permissions to create instances can write files to the host system. This occurs due to unvalidated dependent custom volume names within the instance backup index.yaml files. An attacker can import a specially crafted instance backup containing ../ sequences in the dependent volume names to create root-owned directories with controlled content, which can lead to full host compromise.

Recommendations Update Incus versions 7.0.0 through 7.0.1 to version 7.0.2. Update Incus versions 7.1.0 through 7.4.9 to version 7.5.0.