---
id: CVE-2026-115378
title: >-
  github.com/lxc/incus: Incus: Arbitrary file write on the host via recursive
  file pull (CVE-2026-115378)
summary: >-
  A flaw was found in Incus. A privileged attacker within a virtual machine can
  write arbitrary files to the host system during a recursive file pull
  operation. By manipulating the guest agent to return duplicate file entries
  alternating bet…
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N'
cvssSource: vendor
cwe:
  - CWE-59
vendor: Red Hat
product: incus
affected:
  - incus < 6.0.7
  - incus >= 6.1.0 < 7.0.2
  - incus >= 7.1.0 < 7.5.0
published: '2026-10-22'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T17:24:41+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115378.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115378.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-115378'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-115378'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-115378'
  - url: 'https://github.com/lxc/incus/security/advisories/GHSA-wfvq-qh87-gm4j'
  - url: >-
      https://www.vulncheck.com/advisories/incus-before-6.0.7-6.1.0-before-7.0.2-and-7.1.0-before-7.5.0-arbitrary-file-write-via-recursive-file-pull
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00287
epssPercentile: 0.21326
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-23T14:48:27.087575Z'
ingestedAt: '2026-10-22T22:00:50.402Z'
---

## Overview

A flaw was found in Incus. A privileged attacker within a virtual machine can write arbitrary files to the host system during a recursive file pull operation. By manipulating the guest agent to return duplicate file entries alternating between symbolic links and regular files, the attacker can cause the transfer process to escape the intended destination directory. This allows the attacker to overwrite sensitive files on the operator's host, potentially compromising the host system.

## Vendor advisories

- **Red Hat VEX** · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115378.json)

**github.com/lxc/incus: Incus: Arbitrary file write on the host via recursive file pull**. Released 2026-10-22, updated 2026-10-23.

Not affected:

- All currently supported Red Hat products

## Remediation

Refer to the advisory for fix availability.