Critical Incus Flaw Lets Backup Imports Overwrite Host Files
A path traversal bug in Incus container software allows users who create instances to write root files to the host system, risking full compromise.
Key points
- CVE-2026-115375 is rated 9.4 CVSS CRITICAL for Incus versions 7.0.0 through 7.0.1 and 7.1.0 through 7.4.9.
- Attackers exploit unvalidated volume names in backup index files to create root-owned directories with controlled content.
- The flaw enables clients with instance creation privileges to write files directly on the host operating system.
Incus container management software contains a critical security flaw that allows attackers to compromise the underlying host system. The vulnerability, tracked as CVE-2026-115375, affects specific versions of the software. It enables clients able to create instances to bypass intended security boundaries and write files directly to the host machine, potentially gaining full control over the infrastructure running the containers.
The risk
The flaw stems from improper validation of dependent custom volume names within instance backup index.yaml files. According to the National Vulnerability Database record, an attacker can craft an instance backup that includes directory traversal sequences, such as ../, in these volume names. When this malicious backup is imported, the system processes the unvalidated paths, allowing the creation of root-owned directories containing attacker-controlled content. This mechanism effectively grants the attacker the ability to write arbitrary files to the host system, leading to a full compromise of the environment.
Who is exposed
Organizations using Incus version 7.0.0 up to, but not including, version 7.0.2 are exposed to this threat. Similarly, deployments running version 7.1.0 up to, but not including, version 7.5.0 are also vulnerable. Clients or user accounts within these environments that possess the capability to create instances can potentially exploit this weakness. This includes internal users with elevated privileges as well as external partners or multi-tenant customers who are granted instance creation rights in shared infrastructure setups.
Cost and compliance
The National Vulnerability Database assigns a CVSS score of 9.4 to CVE-2026-115375, classifying the severity as critical. The underlying weakness is identified as CWE-22, which denotes improper limitation of a pathname to a restricted directory. This classification highlights the fundamental failure in input validation that allows the path traversal attack to succeed. The high severity rating reflects the significant impact of the vulnerability, which results in a complete loss of host integrity and confidentiality for affected systems.
What happens next
Security teams should immediately inventory their container infrastructure to identify any systems running the affected Incus versions. Organizations must restrict instance creation privileges to the smallest necessary group of users until remediation is complete. Monitoring for unusual file creation activities on the host system, particularly in root-owned directories, is essential to detect potential exploitation attempts.
Questions to ask your suppliers
Organizations should ask their infrastructure providers whether they manage the underlying container orchestration software or if the customer retains that responsibility. Teams usually need to determine who holds the credentials capable of creating instances and importing backups. Check whether the supplier has a process for validating the integrity of backup files before they are processed by the system. Ask who inside your organization needs to be notified if a supplier confirms they are running an unpatched version of the affected software.
Background: National Vulnerability Database
The National Vulnerability Database is a centralized repository that standardizes information about software weaknesses. It assigns unique identifiers to each flaw, allowing security tools to automatically detect and assess risks in your systems without manual research.
Read the full guide: National Vulnerability Database Explained: How NVD Works for You
What to do and how to stay safe: Incus
- Audit all Incus environments to verify if they are running versions prior to 7.0.2 or 7.5.0, and isolate them if they are.
- Restrict the ability to create instances and import backups to strictly necessary administrative accounts to limit the attack surface.
- Monitor host systems for unauthorized file creation or modification, especially in root directories, to detect signs of exploitation.
- Review access controls to ensure no external users or third-party services have permissions to manage instance backups on critical hosts.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Incus are vulnerable to CVE-2026-115375?
Versions 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 are affected by this path traversal vulnerability.
How does an attacker exploit this vulnerability?
Attackers import a crafted instance backup with directory traversal sequences in dependent volume names to write files to the host.
What is the CVSS score for this flaw?
The National Vulnerability Database rates CVE-2026-115375 with a CVSS score of 9.4, which is classified as critical.
