Summary
generated automatically from NVD dataIncus versions 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 have a path traversal flaw (CWE-22) caused by unvalidated dependent custom volume names in the index.yaml file of instance backups. A client able to create instances can import a crafted backup containing ../ sequences in those names, making the host create root-owned directories with attacker-controlled content. This can lead to full host compromise, and the flaw is rated CRITICAL with a CVSS v3.1 score of 9.9.
NVD description
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 22 oct. 2026
- Updated
- 22 oct. 2026
- Status
- Received
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-22
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.