CVE-2026-115378

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-115378
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115378.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-115378
Aliases
  • GHSA-wfvq-qh87-gm4j
Downstream
Published
2026-10-22T19:13:47Z
Modified
2026-10-28T02:30:49Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N CVSS Calculator
Summary
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Recursive File Pull
Details

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-59"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/115xxx/CVE-2026-115378.json"
}
References

Affected packages

Git / github.com/lxc/incus

Affected ranges

Type
GIT
Repo
https://github.com/lxc/incus
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7678ccc46b2d0b8092b2b9419ab6255e3ca98f00
Introduced
38d0bc57d4ae8926b0adfad475f2d4ca70a1c734
Fixed
01f81e5e607bbb5818410318e4b3496ad1820824
Introduced
42da2b16a4c8ed23f7b3bc50d7736d795f9a963a
Fixed
782340c5aef615c2b4945ddd57587d8198d3aa4d
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "6.0.7"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "6.1.0"
                },
                {
                    "fixed": "7.0.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "7.1.0"
                },
                {
                    "fixed": "7.5.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.2.0
v0.3.0
v0.4.0
v0.5.0
v0.5.1
v0.6.0
v0.7.0
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.1.0
v6.10.0
v6.10.1
v6.11.0
v6.12.0
v6.13.0
v6.14.0
v6.15.0
v6.16.0
v6.17.0
v6.18.0
v6.19.0
v6.19.1
v6.2.0
v6.20.0
v6.21.0
v6.22.0
v6.23.0
v6.3.0
v6.4.0
v6.5.0
v6.6.0
v6.7.0
v6.8.0
v6.9.0
v7.*
v7.0.0
v7.0.1
v7.1.0
v7.2.0
v7.3.0
v7.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-115378.json"