CVE-2026-115375 lxc CVE debrief

Who should care

Defenders responsible for Incus deployments, particularly those with untrusted or external instance creation access, should assess exposure and prioritize verification and mitigation.

Why it matters

The Incus path traversal vulnerability allows clients to write files on the host, potentially leading to full host compromise. Defenders should prioritize verification, upgrading to unaffected versions, restricting instance creation access, and monitoring for suspicious activity.

• Potential full host compromise via root-owned directories with controlled content
• Possible unauthorized file creation and modification on the host
• Required verification of Incus versions and instance creation access controls
• Necessary monitoring for suspicious instance backup imports and directory creation

Technical summary

The Incus path traversal vulnerability (CVE-2026-115375) allows clients able to create instances to write files on the host via unvalidated dependent custom volume names in instance backup index.yaml files. This vulnerability stems from the lack of validation in the dependent custom volume names used during instance backup, enabling attackers to import crafted instance backups with ../ sequences in dependent volume names. This can lead to the creation of root-owned directories with controlled content, potentially resulting in full host compromise. Defenders should prioritize verifying and upgrading to unaffected Incus versions, restricting instance creation access, and monitoring for suspicious instance backup

Defensive priority

Defenders should prioritize verifying and upgrading to unaffected Incus versions, restricting instance creation access, and monitoring for suspicious instance backup imports.

Recommended defensive actions

• Verify and upgrade to unaffected Incus versions (7.0.2 or later, 7.5.0 or later)
• Restrict instance creation access to trusted users and groups
• Monitor for suspicious instance backup imports and directory creation
• Implement additional security controls, such as file system access restrictions and backup validation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. The source item and supplemental sources offer additional context on the affected versions and potential attack vectors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.