External risk intelligence

Incus Path Traversal Via Instance Backup Dependent Volumes

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-115375

The vulnerability requires an authenticated client with permissions to create instances and import backups to trigger the path traversal. While accessible over a network, this functionality is typically restricted to authorized users or administrators within a private environment rather than being a public-facing service or an edge gateway exposed to the general internet.

Path Traversal

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A path traversal vulnerability has been identified in Incus, allowing authenticated clients to write files to the host system. This could potentially lead to a full compromise of the host.

Allows creating files on host systems.
Matters if you use Incus for instance backups.
Confirm if your Incus is affected by this.

Attack Path

How an attacker could exploit the issue

An attacker with the ability to create instances and import backups can exploit this vulnerability. By crafting a malicious instance backup file with specific sequences in the dependent volume names, an attacker can manipulate file paths. This allows them to write files to arbitrary locations on the host system, potentially leading to complete control of the server.

Authenticated client with instance creation.
Import crafted instance backup file.
Full host compromise.

Live Threat

Current exploitation, exposure, and threat context

Clients with the ability to create instances could write arbitrary files to the host system by importing a specially crafted instance backup. This could lead to the creation of root-owned directories and files, potentially allowing for full compromise of the host.

Host system files and directories.
Via crafted instance backup import.
Full host system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Incus affects environments where clients can create instances, allowing them to write files to the host system through crafted instance backups. Infrastructure or platform teams responsible for Incus deployments should prioritize identifying all instances of the affected technology, confirming their exposure and business criticality, and then coordinating with security and vendor management teams to plan remediation during the next maintenance window.

Infrastructure/Platform teams own the issue.
Verify Incus instance reachability and criticality.
Plan remediation based on verified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Incus and how is it used?

Incus is an open-source system container and virtual machine manager. It provides a platform for users to run and manage isolated Linux environments, often used by developers and system administrators to package applications or provide virtualized services on a host operating system.

What does path traversal mean for CVE-2026-115375?

This vulnerability, classified as CWE-22, occurs when software fails to properly sanitize input containing file system path sequences like '../'. In this case, Incus incorrectly handles volume names within backup files, allowing an attacker to escape intended directories and write files anywhere on the host system.

How is this Incus vulnerability triggered?

An attacker must have existing permissions to create instances and import backups. The flaw is triggered specifically when importing a malicious backup file containing manipulated volume names. Legitimate backup files that do not contain these crafted path sequences do not trigger the vulnerability.

Do I need to worry about this if my Incus setup is internal?

Halo Surface Signal indicates this risk is unlikely to be exploited from the public internet. However, because the vulnerability requires authenticated access, it remains a concern if you allow untrusted users to manage instances, even within a private or internal network environment.

When should I update my Incus installation?

You should plan to update as soon as possible. First, verify your current version against the affected ranges—7.0.0 through 7.0.1 or 7.1.0 through 7.4.x. Coordinate with your infrastructure team to schedule a maintenance window to upgrade to the patched versions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.