Incus: Path traversal via instance backup dependent volumes
Summary
Incus does not validate the names of dependent custom volumes listed in the index.yaml file of an instance backup. A crafted backup with ../ sequences in these names can make the daemon create root-owned directories with attacker-controlled content at arbitrary paths on the host. Any client allowed to create instances (or import instance backups) can exploit this, which can lead to full host compromise. The CVSS 4.0 base score is 9.4 (critical).
Affected
- Incus 7.0.0 before 7.0.2
- Incus 7.1.0 before 7.5.0
Fixed in
- Incus 7.0.2 (7.0 LTS line)
- Incus 7.5.0 (7.x line); the latest release is recommended
Workaround
- Only allow trusted clients to create instances, as stated by the vendor advisory.
Exploitation
- No public proof of concept found.
- No evidence found that the vulnerability is known to be exploited in the wild (KEV status).
- Exploitation requires an authenticated client identity allowed to create instances (PR:L).
Our recommendation
- Inventory all Incus hosts and their versions.
- Upgrade to Incus 7.0.2 (7.0 LTS) or 7.5.0 or later (latest release preferred).
- Review and restrict which users and projects may create instances or import instance backups.
- Only import instance backups from trusted sources.
- Check whether the Incus API is reachable from untrusted networks and restrict access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-hpjh-q53p-f27r github.com
- VulnCheck advisory www.vulncheck.com
- Incus news (Linux Containers) linuxcontainers.org
- Ubuntu CVE tracker ubuntu.com
- Debian BSA-139 security update for Incus backports.debian.org
- Flatcar security triage issue 505 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:56.
Original description (NVD)
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.