Incus Backup Flaw Lets Attacker Write Host Files, Full Compromise Possible

Incus versions 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contain a critical security flaw that allows clients with instance creation privileges to write files directly to the host system. The vulnerability, tracked as CVE-2026-115375, stems from insufficient validation of dependent custom volume names within instance backup index.yaml files. According to the National Vulnerability Database, this path traversal issue enables attackers to craft malicious backups containing directory traversal sequences.

How it unfolded

• The National Vulnerability Database recorded CVE-2026-115375, assigning it a CVSS base score of 9.4, indicating a critical severity level.
• Researchers identified that the flaw allows the creation of root-owned directories on the host machine by exploiting unvalidated volume names in backup data.
• The vulnerability is classified under CWE-22, highlighting improper limitation of a pathname to a restricted directory, which facilitates the path traversal attack vector.

Who is affected

Organizations running Incus 7.0.0 or 7.1.0 are vulnerable if they have not updated to 7.0.2 or 7.5.0 respectively. The flaw specifically impacts any client that possesses the ability to create instances within the Incus environment. The ability to write arbitrary files to the host means that any system running these affected versions is at risk of full compromise if an attacker can import a crafted backup.

Our take on the response

The National Vulnerability Database confirms that versions 7.0.2 and 7.5.0 address this specific vulnerability. This indicates that the vendor has released patches to close the path traversal gap in the backup import process. The high severity rating reflects the potential for complete host takeover, suggesting that the fix is essential for maintaining system integrity. Users on older branches must upgrade to the specified patched versions to mitigate the risk of unauthorized file writes and subsequent privilege escalation.

Who needs to act first

Managed service providers should prioritize updating exposed Incus instances immediately, especially those accessible to external clients or untrusted internal users. Teams usually begin by identifying all systems running vulnerable versions through inventory scans. Before applying the update, it is prudent to back up current configurations and instance states to prevent data loss during the upgrade process. Testing the patched version in a non-production environment helps ensure that existing workflows remain stable after the fix is deployed.

Background: Attack vectors

Attack vectors are the paths adversaries use to reach your data. They range from simple phishing emails to complex supply chain compromises. Defending against them requires mapping every entry point, validating inputs, and limiting what each component can do. You cannot stop all attacks, but you can make them costly and slow.

Read the full guide: Attack Vectors Explained: Mechanisms, Limits, and Defense Strategies

What to do and how to stay safe: Incus

• Verify which Incus versions are running on your infrastructure and compare them against the affected ranges listed in the advisory.
• Restrict the ability to create instances and import backups to trusted administrators only, reducing the attack surface while updates are prepared.
• Monitor system logs for unusual file creation events or unexpected directory structures, which could indicate an attempt to exploit the path traversal flaw.
• Once the vendor provides an update, apply the patch to all affected systems and validate that the new version is correctly installed and functioning.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-115375?

The National Vulnerability Database assigns a CVSS score of 9.4 to this vulnerability, rating it as critical.

Which Incus versions are vulnerable to this flaw?

Incus versions 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 are affected by this path traversal vulnerability.

How can an attacker exploit this vulnerability?

Attackers can import a crafted instance backup containing directory traversal sequences in dependent volume names to write files to the host.