What’s Vulnerable › Vulnerabilities

CVE-2026-115375: Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-23
• Weakness: CWE-22

Description

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise.

Affected products

• lxc incus: from 7.0.0 before 7.0.2; from 7.1.0 before 7.5.0 — fixed in 7.0.2, 7.5.0

How to fix

Upgrade to a fixed version: lxc incus 7.0.2, 7.5.0. Check the vendor advisory for mitigations.

References

• https://github.com/lxc/incus/security/advisories/GHSA-hpjh-q53p-f27r
• https://www.vulncheck.com/advisories/incus-7.0.0-before-7.0.2-and-7.1.0-before-7.5.0-path-traversal-via-instance-backup-dependent-volumes

Get alerted when CVE-2026-115375 or the next vulnerability affects your stack