CVE-2026-115375 is a critical path traversal flaw in Incus. Any client allowed to create instances can import a crafted instance backup that writes files on the host, which could lead to full host compromise.
What Is It
CVE-2026-115375 is a path traversal vulnerability (CWE-22) in Incus, the container and virtual machine manager from the LXC project. The flaw is in how Incus handles instance backups. The index.yaml file inside an instance backup lists dependent custom volume names, and Incus does not validate them.
An attacker can import a crafted instance backup whose dependent volume names contain ../ sequences. Incus then creates root-owned directories with attacker-controlled content outside the intended location. According to the advisory, this can lead to full host compromise. VulnCheck disclosed the issue and NVD published it on 2026-10-22. Its NVD status is currently "Received."
Why It Matters
VulnCheck scores this flaw CVSS 3.1 9.9 (Critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Under CVSS 4.0 it scores 9.4 (Critical).
- Low barrier: The attacker only needs network access, low privileges (the ability to create instances) and no user interaction.
- Scope change: The CVSS vector rates the attack as able to escape the instance boundary and affect the host itself.
- Potential impact: Confidentiality, integrity and availability impacts are all rated High, for both the vulnerable system and downstream systems.
On multi-tenant or shared Incus hosts where untrusted users can create instances, this flaw could undermine the isolation between tenants and the host.
As of this writing, the supplied data has no CISA Known Exploited Vulnerabilities (KEV) entry for CVE-2026-115375, so active exploitation in the wild is not confirmed.
What's Vulnerable
Package: github.com/lxc/incus/v7/cmd/incusd
| Version range | Status |
|---|---|
| 7.0.0 up to (not including) 7.0.2 | Affected |
| 7.0.2 | Not affected |
| 7.1.0 up to (not including) 7.5.0 | Affected |
| 7.5.0 | Not affected |
Patch Status
Fixed versions are available:
- 7.0.x branch: upgrade to 7.0.2 or later.
- 7.1.x and later: upgrade to 7.5.0 or later.
There is no KEV entry, so CISA has not set a required action or due date. Given the critical severity and the possible host-level impact, prioritize patching any Incus deployment where non-administrative or untrusted clients can create instances or import backups. For remediation details, see the upstream GitHub security advisory.