Incus Path Traversal in Backups Allows Host File Overwrite
A critical flaw in Incus backup processing allows instance creators to write root files on the host system, risking full compromise.
Key points
- CVE-2026-115375 affects Incus versions before 7.0.2 and 7.5.0
- Attackers use crafted backup files with path traversal sequences
- The vulnerability enables writing root-owned directories on the host
A path traversal vulnerability in Incus allows users who can create instances to write arbitrary files on the underlying host system. This flaw, rated critical by the NVD, exists in versions prior to 7.0.2 and 7.5.0 and stems from insufficient validation of volume names within backup index files.
What happened
The vulnerability, identified as CVE-2026-115375, arises from unvalidated dependent custom volume names in instance backup index.yaml files. An attacker who possesses the ability to create instances can craft a malicious backup archive containing specific sequences. According to the National Vulnerability Database, these crafted backups utilise '../' sequences within volume names to traverse directory paths during import.
This manipulation allows the importer to create root-owned directories with content controlled by the attacker. The process results in the creation of files on the host system rather than within the isolated instance environment. Such actions can lead to full host compromise, effectively bypassing the isolation guarantees provided by the container platform.
Why it matters
Environments running Incus versions earlier than 7.0.2 or 7.5.0 are exposed to this risk. Any client or service account granted permissions to create instances can potentially exploit this mechanism. The flaw turns the backup import feature into a vector for privilege escalation and host-level file manipulation. This highlights the importance of validating input in auxiliary features to prevent broader system exposure.
Next steps
- Audit all Incus installations to identify versions preceding 7.0.2 or 7.5.0
- Review permissions for users and services capable of creating instances
- Monitor backup import logs for unusual volume name patterns or errors
- Restrict backup import capabilities to trusted administrative accounts only
Detection notes
Security operations teams should monitor for anomalies during backup restoration processes. Look for unexpected file system changes on the host immediately following import operations. Check for attempts to access or create files outside standard container directories. Alert on any volume names containing path traversal sequences or non-standard characters. Verify that backup metadata matches expected structural norms before processing. Investigate any root-owned file creations that lack corresponding administrative audit trails. Ensure logging captures the full path resolution during volume mounting to detect manipulation attempts early.
What to do and how to stay safe: Incus
- Verify your Incus version and upgrade if it is below 7.0.2 or 7.5.0 once the vendor provides an update
- Restrict the ability to import backups to a small group of trusted administrators
- Implement strict input validation for any custom volume names used in backup configurations
- Monitor host file system integrity for unauthorized changes following backup operations
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Incus versions are vulnerable to CVE-2026-115375?
Incus versions before 7.0.2 and versions before 7.5.0 are affected by this vulnerability.
How does the path traversal occur in this flaw?
It occurs through unvalidated dependent custom volume names in instance backup index.yaml files using '../' sequences.
What is the potential impact of exploiting this vulnerability?
Exploitation can lead to full host compromise by creating root-owned directories with controlled content on the host.
