CVE-2026-115377

Name of the Vulnerable Software and Affected Versions Incus versions prior to 6.0.7 Incus versions 6.1.0 through 7.0.1 Incus versions 7.1.0 through 7.4.9

Description An arbitrary file write issue exists where malicious migration sources can write files to the host system by planting symlinks within transferred volumes. Attackers can craft rsync or btrfs receive streams containing a symlink, such as rootfs, that points to the host root directory, enabling them to write files as root and achieve full host compromise.

Recommendations Update Incus to version 6.0.7 or later. Update Incus to version 7.0.2 or later. Update Incus to version 7.5.0 or later.