Advisory · CVE-2026-115375
Incus instance backup import writes files on the host through dependent volume names
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 does not validate the dependent custom volume names inside an instance backup, so a client allowed to create instances can use dot-dot sequences to have the daemon create root-owned directories with controlled content at arbitrary host paths. CVSS 3.1 9.9.
- Vendor
- Linux Containers
- Product
- Incus
- Identifier / CWE
- CVE-2026-115375
CWE-22 - Action timing
- Immediate
Explain it like I’m five
When you restore a backup, Incus checks the name on the main folder but not the names of the extra storage folders listed inside it, so an attacker can write folder names that climb out of the storage area and plant files anywhere on the host.
- 01Client imports a crafted backup
A client allowed to create instances in a project imports an instance backup whose index file lists dependent custom volumes with traversal sequences in their names.
- 02Dependent names skip validation
Per the Incus advisory, the backup import validates the instance and snapshot names, but not the dependent custom volume names, which are used verbatim as path segments.
- 03Daemon writes outside the pool
The names flow into path joining and directory creation, so the daemon creates the volume outside the storage pool directory.
- 04Host files are planted
The daemon creates root-owned directories populated with attacker-controlled content at arbitrary host paths, which Incus states leads to full host compromise.
What happened
The Incus project disclosed CVE-2026-115375 in its GitHub security advisory: importing an instance backup validates the instance name and snapshot names, but not the names of the dependent custom volumes listed in the backup index file. Those names are used verbatim as path segments when creating the volume on the target storage pool, so a traversal chain escapes the storage pool directory. The CVE record lists Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 as affected. The CVSS 3.1 score is 9.9, with network attack vector, low complexity, low privileges required, no user interaction, and changed scope.
Per the advisory, any client allowed to create instances in a project can have the Incus daemon create root-owned directories, populated with attacker-controlled content, at arbitrary paths on the host, leading to full host compromise. The backup also names the project each dependent volume is created in, so the same request could create custom volumes in projects the caller has no access to. The CVE record lists 7.0.2 and 7.5.0 as the fixed releases for the affected lines. As a workaround, Incus advises only allowing trusted clients to create instances.
What to do
- Inventory Incus hosts and clusters and note the version of each daemon, including single-node test and lab deployments.
- Upgrade affected installations to Incus 7.0.2 or 7.5.0 or later for the branch in use, using the Incus project release guidance.
- Until every host is upgraded, restrict instance creation to trusted clients, as the Incus advisory advises.
- Audit recent instance backup imports, especially backups supplied by less-trusted project members, and look for dependent volume names containing traversal sequences or volumes created in unexpected projects.
- Check host filesystems outside the storage pools for unexpected root-owned directories or files created by the Incus daemon, and verify the deployed version on every host after updating.
Management note
This turns a routine tenant operation, importing a backup, into a host-level write primitive on shared virtualization infrastructure. On multi-tenant Incus hosts this is a patch-today item, and imports from untrusted projects deserve a look back.