# CVE-2026-115377: Incus arbitrary file write via symlink in migration

Source: https://junglewise.ai/threats/cve-2026-115377-incus-before-6-0-7-6-1-0-before-7-0-2-and-7-1-0-before-7-5-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-115377 · Severity: critical · CVSS 9.9 · Published 2026-10-22

Incus is a container and virtual machine manager that supports migrating instances between hosts. During migration, a malicious source can craft data streams containing symlinks that point to arbitrary host paths, allowing attackers to write files as root and compromise the target system entirely. Any user permitted to create instances or volumes, or any server configured as a migration source, can execute this attack.

Vendors: [Linux Containers](https://junglewise.ai/threats/vendors/linux-containers).

## Quick answers

**Is CVE-2026-115377 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115377 being exploited in the wild.

**How severe is CVE-2026-115377?** Critical severity, with a CVSS score of 9.9, published 22 October 2026.

**Which products and versions are affected?** Linux Containers Incus before 6.0.7, 6.1.0 before 7.0.2, 7.1.0 before 7.5.0.

**Is there a fix for CVE-2026-115377?** Yes: fixed in 6.0.7, 7.0.2, 7.5.0. Until then: Only allow trusted clients to create instances and custom volumes, and only migrate from trusted migration sources. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115377 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-115377?** Check whether you run Linux Containers Incus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.0.7, 7.0.2, 7.5.0

Only allow trusted clients to create instances and custom volumes, and only migrate from trusted migration sources.

## Technical details

The vulnerability exists in how Incus handles rsync and btrfs receive streams during instance and volume migration. Both tools follow symlinks in the paths they write to, and a malicious source can plant a symlink (e.g., rootfs → /) early in the stream to redirect subsequent writes to arbitrary host locations. The symlink check introduced in Incus 7.3 runs only after the transfer completes, failing to prevent the writes. Attacks require network access and low privileges (ability to create instances/volumes or control a migration source).

## Affected products

- Linux Containers Incus before 6.0.7, 6.1.0 before 7.0.2, 7.1.0 before 7.5.0

## Timeline

- 2026-09-25: disclosed
- 2026-10-22: advisory

## References

- [https://github.com/lxc/incus/security/advisories/GHSA-579w-c4rw-c8q3](https://github.com/lxc/incus/security/advisories/GHSA-579w-c4rw-c8q3)
- [https://www.vulncheck.com/advisories/incus-before-6.0.7-6.1.0-before-7.0.2-and-7.1.0-before-7.5.0-arbitrary-file-write-via-symlink-in-migration-stream](https://www.vulncheck.com/advisories/incus-before-6.0.7-6.1.0-before-7.0.2-and-7.1.0-before-7.5.0-arbitrary-file-write-via-symlink-in-migration-stream)