Arbitrary File Write Vulnerability in Incus Affecting Multiple Versions

CVE-2026-115378

What is CVE-2026-115378?

Incus contains a vulnerability that allows malicious actors to exploit the sftpRecursivePullFile feature, facilitating arbitrary file write operations. This issue enables attackers with root access in a virtual machine to write files to unauthorized locations on the operator's host machine. During file retrieval, the attacker can introduce controlled files, including critical system files, by leveraging symlink vulnerabilities. This may lead to significant security breaches if left unaddressed.

References