CVE-2026-115377
Critical · 9.9CVSS
9.9
EPSS
0.4%
Published
Oct 22, 2026
CISA due date
—
The record
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119336 Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing… CWE-59
- CVE-2026-119334 Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing… CWE-59
- CVE-2026-116250 In server mode pgAdmin 4 validates a path a user gives for a file in their storage… CWE-59
- CVE-2026-119704 Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh… CWE-59
- CVE-2026-119291 Zuke is a code-first, strongly typed build automation system for Deno. CWE-59
- CVE-2026-118990 CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the… CWE-59
- CVE-2026-119364 ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following… CWE-59
- CVE-2026-119168 HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during… CWE-59