CVE-2026-115375: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in lxc incus

CVE-2026-115375 is a critical path traversal vulnerability in the lxc Incus container management software. It affects versions 7.0.0 up to but not including 7.0.2, and 7.1.0 up to but not including 7.5.0. The flaw is due to insufficient validation of dependent custom volume names in instance backup index.yaml files. Attackers who can create instances can import a maliciously crafted instance backup containing '../' sequences in volume names, enabling them to write files outside the intended directory boundaries on the host. This can lead to creation of root-owned directories with attacker-controlled content, resulting in full host compromise.

Successful exploitation allows an attacker with instance creation privileges to write arbitrary files on the host system with root ownership. This can lead to full host compromise, including unauthorized access, privilege escalation, and persistent control over the host environment.

A fix is available in Incus versions 7.0.2 and 7.5.0 and later. Users should upgrade to these versions or later to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official patch.