{"id":"CVE-2026-115378","title":"github.com/lxc/incus: Incus: Arbitrary file write on the host via recursive file pull (CVE-2026-115378)","summary":"A flaw was found in Incus. A privileged attacker within a virtual machine can write arbitrary files to the host system during a recursive file pull operation. By manipulating the guest agent to return duplicate file entries alternating bet…","severity":"medium","cvss":5.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N","cvssSource":"vendor","cwe":["CWE-59"],"vendor":"Red Hat","product":"incus","affected":["incus < 6.0.7","incus >= 6.1.0 < 7.0.2","incus >= 7.1.0 < 7.5.0"],"published":"2026-10-22","updated":"2026-10-23","sourceUpdated":"2026-10-23T17:24:41+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115378.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115378.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-115378"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-115378"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115378"},{"url":"https://github.com/lxc/incus/security/advisories/GHSA-wfvq-qh87-gm4j"},{"url":"https://www.vulncheck.com/advisories/incus-before-6.0.7-6.1.0-before-7.0.2-and-7.1.0-before-7.5.0-arbitrary-file-write-via-recursive-file-pull"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00287,"epssPercentile":0.2108,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-23T14:48:27.087575Z"},"ingestedAt":"2026-10-22T22:00:50.402Z","slug":"CVE-2026-115378","body":"## Overview\n\nA flaw was found in Incus. A privileged attacker within a virtual machine can write arbitrary files to the host system during a recursive file pull operation. By manipulating the guest agent to return duplicate file entries alternating between symbolic links and regular files, the attacker can cause the transfer process to escape the intended destination directory. This allows the attacker to overwrite sensitive files on the operator's host, potentially compromising the host system.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115378.json)\n\n**github.com/lxc/incus: Incus: Arbitrary file write on the host via recursive file pull**. Released 2026-10-22, updated 2026-10-23.\n\nNot affected:\n\n- All currently supported Red Hat products\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}