Incus: Path traversal vulnerability (CVE-2026-115375)

Incus versions 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 are affected by a path traversal vulnerability (CVE-2026-115375) in the processing of instance backup files. The vulnerability exists due to improper validation of dependent custom volume names within the index.yaml file of an instance backup. An attacker with authorization to create instances can provide a crafted backup file containing directory traversal sequences (../) in these volume names to write files to arbitrary locations on the host filesystem. Successful exploitation allows an attacker to create root-owned directories and write arbitrary content, leading to full host compromise.

Impact

Successful exploitation allows for arbitrary file writes on the host system as root, leading to complete host compromise.

Recommendation

• Upgrade Incus to version 7.0.2 or 7.5.0, or later, as specified in the vendor advisory.
• Audit existing instance backup archives for unauthorized modifications or unexpected path patterns in index.yaml files.
• Review permissions for users authorized to perform instance backup imports to minimize the attack surface.