Arbitrary File Write Vulnerability in Incus by LXD
CVE-2026-115377

9.4CRITICAL

Key Information:

Vendor

Lxc

Status
Incus
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115377?

The Incus platform versions prior to 6.0.7, along with the specified versions under active maintenance, are susceptible to an arbitrary file write vulnerability. This flaw allows attackers to exploit symlinks in migration streams, specifically through rsync or btrfs, enabling them to write files into the host environment with elevated root privileges. Such unauthorized access paves the way for complete host compromise, presenting severe risks to the integrity and confidentiality of system resources.

Affected Version(s)

incus 0 < 6.0.7

incus 6.1.0 < 7.0.2

incus 7.1.0 < 7.5.0

References

https://github.com/lxc/incus/security/advisories/GHSA-579...
vendor-advisory
https://www.vulncheck.com/advisories/incus-before-6.0.7-6...
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
stgraber
.