DEBIAN-CVE-2026-115378

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-115378
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-115378.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-115378
Upstream
Published
2026-10-23T09:47:26Z
Modified
2026-10-23T10:00:06Z
Summary
[none]
Details

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious incus-agent to escape the target directory during incus file pull -r. Attackers with root in a virtual machine can return duplicate entries reported first as symlinks then as files or directories, writing attacker-controlled files such as /etc/shadow on the operator's host.

References

Affected packages

Debian:13 / incus

Package

Name
incus
Purl
pkg:deb/debian/incus?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

6.*
6.0.4-2
6.0.4-2+deb13u1~bpo12+1
6.0.4-2+deb13u1
6.0.4-2+deb13u2~bpo12+1
6.0.4-2+deb13u2
6.0.4-2+deb13u3~bpo12+1
6.0.4-2+deb13u3
6.0.4-2+deb13u4~bpo12+1
6.0.4-2+deb13u4
6.0.4-2+deb13u5~bpo12+1
6.0.4-2+deb13u5
6.0.4-2+deb13u6~bpo12+1
6.0.4-2+deb13u6
6.0.4-2+deb13u7~bpo12+1
6.0.4-2+deb13u7
6.0.4-2+deb13u8
6.0.4-2+deb13u9
6.0.4-2+deb13u10
6.0.4-2+deb13u11
6.0.4-3
6.0.5-1
6.0.5-2
6.0.5-3
6.0.5-4
6.0.5-5
6.0.5-6
6.0.5-7
6.0.5-8
6.0.6-1
6.0.6-2
6.0.6-3
6.14.0-1~exp1
6.15.0-1~exp1
6.16.0-1~exp1
6.17.0-1~exp1
6.20.0-1~exp1
6.21.0-1~exp1
6.22.0-1~exp1
6.23.0-1~exp1
7.*
7.0.0-1~bpo13+1
7.0.0-1
7.0.0-2~bpo13+1
7.0.0-2
7.0.0-3
7.0.0-4
7.0.0-5~bpo13+1
7.0.0-5
7.0.1-1~bpo13+1
7.0.1-1
7.0.1-2~bpo13+1
7.0.1-2
7.0.1-3~bpo13+1
7.0.1-3
7.0.1-4
7.0.1-5~bpo13+1
7.0.1-5
7.0.1-6
7.0.2-1
7.0.2-2
7.1.0-1~exp1
7.2.0-1~exp1
7.2.0-1~exp2
7.2.0-1~exp3
7.3.0-1~exp1
7.4.0-1~exp1
7.5.1-1~exp1
7.5.1-1~exp2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-115378.json"

Debian:14 / incus

Package

Name
incus
Purl
pkg:deb/debian/incus?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
7.0.1-5

Affected versions

6.*
6.0.4-2
6.0.4-3
6.0.5-1
6.0.5-2
6.0.5-3
6.0.5-4
6.0.5-5
6.0.5-6
6.0.5-7
6.0.5-8
6.0.6-1
6.0.6-2
6.0.6-3
6.14.0-1~exp1
6.15.0-1~exp1
6.16.0-1~exp1
6.17.0-1~exp1
6.20.0-1~exp1
6.21.0-1~exp1
6.22.0-1~exp1
6.23.0-1~exp1
7.*
7.0.0-1~bpo13+1
7.0.0-1
7.0.0-2~bpo13+1
7.0.0-2
7.0.0-3
7.0.0-4
7.0.0-5~bpo13+1
7.0.0-5
7.0.1-1~bpo13+1
7.0.1-1
7.0.1-2~bpo13+1
7.0.1-2
7.0.1-3~bpo13+1
7.0.1-3
7.0.1-4
7.0.1-5~bpo13+1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-115378.json"