CVE-2026-115377
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write…
- Risk score
- 66/100
- CVSS
- 9.9 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Incus versions 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contain an arbitrary file write vulnerability, allowing malicious migration sources to write host files. This can lead to full host compromise.
- Affected
- {'products': ['Incus'], 'packages': [], 'versions': ['6.0.7', '6.1.0 before 7.0.2', '7.1.0 before 7.5.0']}
- Fix
- Upgrade to version 7.5.0 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.9 critical
References
Original description
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.
Last activity 22 Oct 2026. Patch Forecast updates every hour.