{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aincusincus/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:incus:incus:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-115375"},{"id":"CVE-2026-115371"},{"id":"CVE-2026-115377"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Incus (7.0.0-7.0.1, 7.1.0-7.4.0)","Incus (\u003c 6.0.7)","Incus (\u003e= 6.1.0, \u003c 7.0.2)","Incus (\u003e= 7.1.0, \u003c 7.5.0)","Incus (6.0.3-6.0.6, 6.6.0-7.0.1, 7.1.0-7.4.x)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","privilege-escalation","linux"],"_cs_type":"advisory","_cs_vendors":["Incus"],"content_html":"\u003cp\u003eIncus versions 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 are affected by a path traversal vulnerability (CVE-2026-115375) in the processing of instance backup files. The vulnerability exists due to improper validation of dependent custom volume names within the index.yaml file of an instance backup. An attacker with authorization to create instances can provide a crafted backup file containing directory traversal sequences (../) in these volume names to write files to arbitrary locations on the host filesystem. Successful exploitation allows an attacker to create root-owned directories and write arbitrary content, leading to full host compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary file writes on the host system as root, leading to complete host compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Incus to version 7.0.2 or 7.5.0, or later, as specified in the vendor advisory.\u003c/li\u003e\n\u003cli\u003eAudit existing instance backup archives for unauthorized modifications or unexpected path patterns in index.yaml files.\u003c/li\u003e\n\u003cli\u003eReview permissions for users authorized to perform instance backup imports to minimize the attack surface.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T22:30:47Z","date_published":"2026-10-22T20:27:23Z","id":"https://feed.craftedsignal.io/briefs/2026-10-incus-path-traversal/","summary":"Incus versions 7.0.0 through 7.0.1 and 7.1.0 through 7.4.0 contain a path traversal vulnerability in instance backup processing that allows authenticated attackers to write files to the host filesystem, resulting in full host compromise.","title":"Incus: Path traversal vulnerability (CVE-2026-115375)","url":"https://feed.craftedsignal.io/briefs/2026-10-incus-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:incus:incus:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}