---
id: CVE-2026-115375
title: >-
  Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance
  Backup Dependent Volumes
summary: >-
  Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal
  vulnerability that allows clients able to create instances to write files on
  the host. The flaw stems from unvalidated dependent custom volume names in
  instance ba…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
vendor: lxc
product: incus
affected:
  - incus >= 7.0.0 < 7.0.2
  - incus >= 7.1.0 < 7.5.0
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T19:13:44.760Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115375'
references:
  - url: 'https://github.com/lxc/incus/security/advisories/GHSA-hpjh-q53p-f27r'
    label: GitHub Security Advisory (GHSA-hpjh-q53p-f27r)
  - url: >-
      https://www.vulncheck.com/advisories/incus-7.0.0-before-7.0.2-and-7.1.0-before-7.5.0-path-traversal-via-instance-backup-dependent-volumes
    label: >-
      VulnCheck Advisory: Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path
      Traversal via Instance Backup Dependent Volumes
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.401Z'
---

## Overview

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise.

## Affected

- `incus >= 7.0.0 < 7.0.2`
- `incus >= 7.1.0 < 7.5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.