CVE-2026-115378 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull

What is CVE-2026-115378?

CVE-2026-115378 is a medium-severity vulnerability in lxc incus, published on 22 Oct 2026.

Official description

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host.

Weakness: CWE-59

Which versions are affected by CVE-2026-115378?

How do I fix CVE-2026-115378?

Upgrade to a fixed version.

Is CVE-2026-115378 being exploited?

There is no known exploitation of CVE-2026-115378 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-115378, GHSA-38pq-92hw-9rp6, GHSA-wfvq-qh87-gm4j, UBUNTU-CVE-2026-115378.