CVE-2026-115378

Name of the Vulnerable Software and Affected Versions Incus versions prior to 6.0.7 Incus versions 6.1.0 through 7.0.1 Incus versions 7.1.0 through 7.4.9

Description An arbitrary file write issue exists in the sftpRecursivePullFile() function. A malicious incus-agent can escape the target directory during an incus file pull -r operation. An attacker with root privileges in a virtual machine can manipulate the process by returning duplicate entries, reporting them first as symlinks and subsequently as files or directories. This allows the attacker to write controlled files, such as /etc/shadow, directly onto the operator's host system.

Recommendations Update Incus to version 6.0.7 or later. Update Incus to version 7.0.2 or later. Update Incus to version 7.5.0 or later.