What’s Vulnerable › Vulnerabilities

CVE-2026-115377: Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-22 · updated 2026-10-29
• Weakness: CWE-59

Description

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.

Affected products

• lxc incus: before 6.0.7; from 6.1.0 before 7.0.2; from 7.1.0 before 7.5.0 — fixed in 6.0.7, 7.0.2, 7.5.0

How to fix

Upgrade to a fixed version: lxc incus 6.0.7, 7.0.2, 7.5.0. Check the vendor advisory for mitigations.

References

• https://github.com/lxc/incus/security/advisories/GHSA-579w-c4rw-c8q3
• https://www.vulncheck.com/advisories/incus-before-6.0.7-6.1.0-before-7.0.2-and-7.1.0-before-7.5.0-arbitrary-file-write-via-symlink-in-migration-stream

Get alerted when CVE-2026-115377 or the next vulnerability affects your stack