CVE-2026-115378

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115378", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-22T11:24:28.627Z", "datePublished": "2026-10-22T19:13:47.035Z", "dateUpdated": "2026-10-23T15:01:16.157Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T19:13:47.035Z"}, "datePublic": "2026-09-25T00:00:00.000Z", "title": "Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull", "descriptions": [{"lang": "en", "value": "Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Link Resolution Before File Access ('Link Following')", "cweId": "CWE-59", "type": "CWE"}]}], "affected": [{"vendor": "lxc", "product": "incus", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/lxc/incus/v7/cmd/incus", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "6.0.7"}, {"version": "6.0.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.0", "status": "affected", "versionType": "semver", "lessThan": "7.0.2"}, {"version": "7.0.2", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.0", "status": "affected", "versionType": "semver", "lessThan": "7.5.0"}, {"version": "7.5.0", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.0", "versionEndExcluding": "7.0.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.0", "versionEndExcluding": "7.5.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-wfvq-qh87-gm4j", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-wfvq-qh87-gm4j)"}, {"name": "VulnCheck Advisory: Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/incus-before-6.0.7-6.1.0-before-7.0.2-and-7.1.0-before-7.5.0-arbitrary-file-write-via-recursive-file-pull"}], "credits": [{"lang": "en", "value": "stgraber", "type": "finder"}, {"lang": "en", "value": "palkeo", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-23T14:48:27.087575Z", "id": "CVE-2026-115378", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-23T15:01:16.157Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115378", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-23T14:48:27.087575Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-23T14:48:27.883Z"}}], "cna": {"title": "Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull", "credits": [{"lang": "en", "type": "finder", "value": "stgraber"}, {"lang": "en", "type": "reporter", "value": "palkeo"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "lxc", "product": "incus", "versions": [{"status": "affected", "version": "0", "lessThan": "6.0.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.0.7", "versionType": "semver"}, {"status": "affected", "version": "6.1.0", "lessThan": "7.0.2", "versionType": "semver"}, {"status": "unaffected", "version": "7.0.2", "versionType": "semver"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.5.0", "versionType": "semver"}, {"status": "unaffected", "version": "7.5.0", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/lxc/incus/v7/cmd/incus", "defaultStatus": "unaffected"}], "datePublic": "2026-09-25T00:00:00.000Z", "references": [{"url": "https://github.com/lxc/incus/security/advisories/GHSA-wfvq-qh87-gm4j", "name": "GitHub Security Advisory (GHSA-wfvq-qh87-gm4j)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/incus-before-6.0.7-6.1.0-before-7.0.2-and-7.1.0-before-7.5.0-arbitrary-file-write-via-recursive-file-pull", "name": "VulnCheck Advisory: Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "Improper Link Resolution Before File Access ('Link Following')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0.7"}, {"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.2", "versionStartIncluding": "6.1.0"}, {"criteria": "cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.5.0", "versionStartIncluding": "7.1.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-22T19:13:47.035Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115378", "state": "PUBLISHED", "dateUpdated": "2026-10-23T15:01:16.157Z", "dateReserved": "2026-10-22T11:24:28.627Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-22T19:13:47.035Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/lxc/incus/v7/cmd/incus", "product": "incus", "vendor": "lxc", "versions": [{"lessThan": "6.0.7", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "6.0.7", "versionType": "semver"}, {"lessThan": "7.0.2", "status": "affected", "version": "6.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "7.0.2", "versionType": "semver"}, {"lessThan": "7.5.0", "status": "affected", "version": "7.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "7.5.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host."}], "id": "CVE-2026-115378", "lastModified": "2026-10-23T17:06:36.030", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 4.0, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115378", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-23T14:48:27.087575Z", "version": "2.0.3"}}]}, "published": "2026-10-22T19:17:44.600", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/lxc/incus/security/advisories/GHSA-wfvq-qh87-gm4j"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/incus-before-6.0.7-6.1.0-before-7.0.2-and-7.1.0-before-7.5.0-arbitrary-file-write-via-recursive-file-pull"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/lxc/incus: Incus: Arbitrary file write on the host via recursive file pull", "id": "2559358", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559358"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-59", "details": ["Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host.", "A flaw was found in Incus. A privileged attacker within a virtual machine can write arbitrary files to the host system during a recursive file pull operation. By manipulating the guest agent to return duplicate file entries alternating between symbolic links and regular files, the attacker can cause the transfer process to escape the intended destination directory. This allows the attacker to overwrite sensitive files on the operator's host, potentially compromising the host system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-115378", "public_date": "2026-10-22T19:13:47Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115378\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115378\nhttps://github.com/lxc/incus/security/advisories/GHSA-wfvq-qh87-gm4j\nhttps://www.vulncheck.com/advisories/incus-before-6.0.7-6.1.0-before-7.0.2-and-7.1.0-before-7.5.0-arbitrary-file-write-via-recursive-file-pull"], "statement": "This vulnerability is rated as Moderate severity because exploitation requires an attacker to already possess elevated administrative privileges within a guest environment and relies on host operator interaction to initiate a recursive transfer. Although successful exploitation could allow writing arbitrary files to the host filesystem, it cannot be triggered autonomously over the network. Incus is not distributed or supported in Red Hat Enterprise Linux, limiting exposure across standard Red Hat enterprise deployments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.0.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.0.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.0,7.0.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "7.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.1.0,7.5.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "7.5.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "incus", "source": "cna", "vendor": "lxc"}, "product": "incus", "vendor": "linuxcontainers"}], "created": "2026-10-23T04:00:12.776329+00:00", "updated": "2026-10-23T05:00:13.479741+00:00", "vendors": ["linuxcontainers", "linuxcontainers$PRODUCT$incus"]}