CVE-2026-115378: Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull

Q: Who is exposed to this issue?

Operators running an affected Incus version are exposed when they recursively pull files from a virtual machine whose incus-agent may be malicious. A user with root access inside that VM can exploit the pull operation against the operator's host.

Q: What action is required to trigger exploitation?

The operator must run "incus file pull -r" against the malicious virtual machine. The malicious agent then returns duplicate entries, first as symlinks and later as files or directories, to escape the intended destination directory.

Q: What is the potential impact on the host?

The attacker can cause writes of attacker-controlled files outside the selected target directory on the operator's host. The advisory gives /etc/shadow as an example target, so integrity of host files is at risk.

Q: Which Incus releases contain the fix?

The issue is fixed in Incus 6.0.7, 7.0.2 for the 6.1.0 release line, and 7.5.0 for the 7.1.0 release line.

Published Oct 22, 2026

Updated

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host.

Affected Software

1 affected component

Linux Containers Incus<6.0.7, >=6.1.0<7.0.2, >=7.1.0<7.5.0

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Operators running an affected Incus version are exposed when they recursively pull files from a virtual machine whose incus-agent may be malicious. A user with root access inside that VM can exploit the pull operation against the operator's host.

What action is required to trigger exploitation?

The operator must run "incus file pull -r" against the malicious virtual machine. The malicious agent then returns duplicate entries, first as symlinks and later as files or directories, to escape the intended destination directory.

What is the potential impact on the host?

The attacker can cause writes of attacker-controlled files outside the selected target directory on the operator's host. The advisory gives /etc/shadow as an example target, so integrity of host files is at risk.

Which Incus releases contain the fix?

The issue is fixed in Incus 6.0.7, 7.0.2 for the 6.1.0 release line, and 7.5.0 for the 7.1.0 release line.

CVE-2026-115378: Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What action is required to trigger exploitation?

What is the potential impact on the host?

Which Incus releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What action is required to trigger exploitation?

What is the potential impact on the host?

Which Incus releases contain the fix?