{"id":"CVE-2026-115377","published":"2026-10-22T19:17:44.460","lastModified":"2026-10-23T17:06:36.030","description":"Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-59"],"vendors":[],"products":[],"references":[{"url":"https://github.com/lxc/incus/security/advisories/GHSA-579w-c4rw-c8q3","tags":[]},{"url":"https://www.vulncheck.com/advisories/incus-before-6.0.7-6.1.0-before-7.0.2-and-7.1.0-before-7.5.0-arbitrary-file-write-via-symlink-in-migration-stream","tags":[]}],"exploitRefs":[{"url":"https://github.com/lxc/incus/security/advisories/GHSA-579w-c4rw-c8q3","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows authenticated attackers to write arbitrary files on the host by injecting symlinks (e.g., 'rootfs') into migration streams, enabling full host compromise via root-level file writes.","exploitability":"Exploitation requires low-privilege access (PR:L) and no user interaction, but is limited to systems where the attacker can control the source of a container or VM migration stream.","blast_radius":"Successful exploitation grants full root access to the host, compromising confidentiality, integrity, and availability across the entire system.","remediation":"Upgrade to Incus 6.0.7, 7.0.2 (for 6.1.x branch), or 7.5.0 (for 7.1.x branch) immediately; no fixed version is published for versions outside these ranges.","detection":"Monitor rsync or btrfs receive logs for unexpected symlink creation in volume rootfs paths, especially symlinks pointing outside the expected container/VM filesystem hierarchy.","tags":["symlink-attack","container-breakout","privilege-escalation","host-compromise","migration-vulnerability"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:51:12.005Z"}}